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CGI Technologies and 
Solutions Inc 
11325 Random Hills 
Road, 7 m Floor 
Fairfax, VA 22030 
Tel 703-267.8000 
Fax, 703-267-5111 
v,VAV.cg!,com 


September 19, 2012 

Mr, Paul Jacoby, Vice President 
Logic-works Systems Corporation 
155 Avenue of the Americas, 5 th FI. 

NY, NY 10013 

RE: Interim Hosting Services for the University of Massachusetts HIX/IES Project 
Dear Steve: 


The purpose of this letter is to document the agreement between Logicworks and CGI pursuant 
to which CGI will purchase interim hosting services from Logicworks (the “Letter Agreement”). 
CGI will use the hosting services provided under this Letter Agreement as a development 
environment for services it intends to provide to the University of Massachusetts Worcester 
Campus (“University") under CGI’s prime contract with the University for the Massachusetts 
Health Insurance Exchange and Integrated Eligibility System (MA HIX/IES): Systems Integrator 
Procurement; RFR Number CW12-JD-0022-0001 (the “Prime Contract”). 

Negotiations between the University and CGI to formalize additional terms and conditions of the 
Prime Contract for the provision of ongoing hosting sendees from Logicworks will proceed in 
the near future. Subject to the execution of a mutually acceptable master services agreement 
between CGI and Logicworks, CGI intends to subcontract a portion of its hosting obligations 
under the Prime Contract to Logicworks and Logicworks desires to provide those services to 
CGI, As such, the parties shall work together in good faith to reach a mutually acceptable 
agreement regarding such terms and conditions 

This letter documents the contractual terms and conditions pursuant to which our teams will 
work on the stan-up activities and interim services required to facilitate such negotiations. As 
previously discussed, Logicworks will provide the start-up hardware, software, operating 
systems, networking equipment, bandwidth, and other products and services (“Interim Hosting 
Services’') described ip the Service Order attached hereto as Exhibit B. 

Logicworks will provide the above services at the rate(s) in the Service Order attached hereto as 
Exhibit B. Logicworks will submit a monthly invoice to CGI, payment terms: Net 60 days from 
receipt of Logicworks' .invoice by CGI. Billing will commence on the date that Logicworks 
provides CGI with Internet access to the Interim Hosting Services. 
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Exhibit A - Additional Business Terms 

1, Termination. This Letter Agreement will automatically terminate at the end of March 
2013 unless it is terminated in accordance with this Section I or the parties enter into a master 
services agreement prior to that time. CGI may terminate this Letter Agreement at anytime by 
giving Logicworks written notice of its intent to terminate. A notice of termination received by 
Logicworks on or before the fifteenth day of a calendar month will become effective at the end 
of that month. A notice of termination received after the fifteenth day of a calendar* month will 
become effective at the end of the following calendar month, In such event, CGI will pay 
Logicworks in full for all Interim Hosting Sendees performed through the effective date of 
termination. Logicworks may terminate the Letter Agreement: (A) if CGI materially breaches 
the Letter Agreement and fails to cure that breach within ten days of receiving a notice from 
Logicworks that identifies the breach; (B) on ten days’ notice if Logicworks is threatened with a 
legal claim relating to CGI’s use of the Interim Hosting Services, including a claim for copyright, 
trademark or patent infringement, and Logicworks is unable to impose restrictions on the Interim 
Hosting Services that result in tire withdrawal of that claim and eliminate the risk of liability for 
similar claims in the future; (C) notwithstanding clause (A) of this Section 1, on ten days' notice 
if CGI fails to pay any fees within sixty days of an invoice date and on two days’ notice if CGI 
violates the AUP more than once; (D) immediately (and without prior notice) pursuant to a 
request or notice from the government or a law enforcement agency; or (E) immediately (and 
without prior notice) if CGI becomes tire subject of a voluntary or involuntary petition in 
bankruptcy or any proceeding relating to insolvency, receivership or liquidation, if such petition 
or proceeding is not dismissed within ninety (90) days of filing. 

2, Suspension. Notwithstanding the foregoing, Logicworks may immediately suspend the 
Interim Hosting Services without prior notice or liability if (A) Logicworks reasonably believes 
that CGI’s use of the Interim Hosting Services has or will subject Logicworks to civil or criminal 
liability; (B) Logicworks reasonably believes that the Interim Hosting Services are being used in 
violation of the Acceptable Use Policy(AUP) attached hereto as Exhibit C; (C) Logicworks is 
required to suspend CGI’s Interim Hosting Services by a law enforcement agency, government 
agency, or court order; (D) activity on CGI’s Servers, such as a denial of service attack or 
unauthorized access, poses a threat to the integrity of Logicworks’ network or Logicworks’ other 
clients; or (E) CG! fails to pay an invoice as per the Letter Agreement. 

3, Non-Disclosure. The following provision shall remain subject to and subordinate to, any 
applicable public disclosure laws, including but not limited to the Massachusetts Public Records 
Law, Mass, Gen. Laws ch, 4 §7 and §26 and ch. 66 §10. Logicworks and CGI agree that in 
connection with the performance of their respective obligations hereunder, each Party may have 
access to the Confidential Information of the other Party. The follow terms will apply to such 
access, 


(a) “Confidential Information”. “Confidential Information” means information belonging to 
or in the possession of a Party which is confidential or a trade secret and is furnished or 
disclosed to the other Party under the Contract (including information exchanged in 
contemplation of entering into the Contract): (i) in tangible form and if provided by 
Contractor, marked or designated in writing in a manner to indicate it is confidential or a 
trade secret; or (ii) in intangible form arid that either is of a nature that a reasonable 
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person would understand to be confidential or a trade secret or is identified as 
confidential or a trade secret in a writing provided to the receiving Party within thirty 
(30) business days after disclosure. 

'‘Confidential Information” does not include any information that, as evidenced by 
written documentation: 

(i) is already known to the receiving Party without restrictions at the time of its 
disclosure by the furnishing Party; 

(ii) after its disclosure by the furnishing Party, is made known to the receiving 
Party without restrictions by a third Part)' having the right to do so; 

(iii) is.or becomes publicly known without violation of the Contract; or 

(jyj is independently developed by the receiving Party without reference to the 
furnishing Party’s Confidential information, 

Confidential Information will remain the property of the furnishing Party, and the 
receiving Party will not be deemed by virtue of the Contract or any access to tire 
furnishing Party’s Confidential Information to have acquired any right, title or interest in 
or to the Confidential Information. The receiving Party agrees: 

(i) to use the furnishing Party’s Confidential Information in accordance with the 
Contract and afford it at least the same level of protection against 
unauthorized disclosure or use as the receiving Party normally uses to protect 
its own information of a similar character, but in no event less than reasonable 
care; 

(ii) to limit disclosure of the furnishing Party’s Confidential information to 
personnel furnished by the receiving Party to perform services under this 
Letter Agreement or otherwise having a need to know the information for the 
purposes of the Letter Agreement (including authorized subcontractors under 
written obligations of confidentiality' at least as stringent as set forth herein); 

(iii) not to disclose any such Confidential Information to any third Party except as 
provided herein; and 

(iv) to notify the furnishing Party promptly of any unauthorized use or disclosure 
of the furnishing Party’s Confidential Information and cooperate With and 
assist tiie furnishing Party iii every reasonable way to Stop or minimize such 
unauthorized use or disclosure. 

if the receiving Party receives a subpoena or other valid administrative or judicial notice 
requesting the disclosure of the furnishing Party’s’Confidential Information, the receiving 
Party will promptly notify the furnishing Party. Subject to its obligations stated in the 
preceding sentence and any applicable public records laws, the receiving Party may 
comply with any valid subpoena or other administrative or judicial process to the extent 
required by law. 

Upon termination or expiration of this Letter Agreement, the receiving Party, at the 
furnishing Party’s option, will return or destroy all Confidential Information of the 
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furnishing Party that the receiving Party docs not possess under a valid license; provided 
that each party may retain one (1) copy for archival purposes. 


Each Party agrees that if a court of competent jurisdiction determines that the receiving 
Party has breached, or attempted or threatened to breach, any of its confidentiality 
obligations to the furnishing Party or the furnishing Party’s proprietary rights, money 
damages will not provide an adequate remedy. Accordingly, the furnishing Party will be 
entitled to seek appropriate injunctive relief and other measures restraining further 


4. Limitation of Liability, 


a, If either party should become entitled to claim damages from the other party 
(including without limitation, for breach of contract, breach of warranty, negligence or 
other tort claim), each party will be liable (in the aggregate for ail claims made with 
respect (o this Letter Agreement) only for the amount of that party ’s actual direct 
damages up to the amount that CGI has been invoiced by Logicworks for the items or 
Interim Hosting Services. In no event will either party, or its respective employees, 
agents or representatives, be liable to the other party for any lost profits, loss of business, 
loss of use, lost savings, lost or damaged data, lost revenue, damage to goodwill, lost 
opportunities, lost revenue, or other consequential, special, incidental, indirect, 
exemplary or punitive damages, even if the party has been advised of the possibility of 
such damages. 

b, Notwithstanding anything in this Letter Agreement to the contrary, in no event 
will Logicworks be liable for falling to provide the Interim Hosting Services unless the 
failure results from Logicworks’ breach of the Service Level Agreement in Section 10 
below or from Logicworks’ or its subcontractors’ gross negligence or intentional 
misconduct. 

c, The parties agree that the foregoing limitations will not be deemed to limit any 
liability to an extent that would not be permitted under applicable law. 

5. Any question or dispute arising out of or relating to this Letter Agreement will be settled 
by arbitration in accordance with the American Arbitration Association’s Commercial Arbitration 
Rules and the Supplementary Procedures for Large, Complex Disputes, except to the extent that 
those rules are inconsistent with this Agreement. Judgment on the award may be entered in any 
court having jurisdiction. The seat of the arbitration will be Washington, D.O. Each party will 
pay its own costs and attorneys’ fees. All fees payable lo the AAA, including all arbitrator lees, 
will be divided equally between the parties, Except as prohibited by applicable law, the 
arbitrators will have no authority to award any damages that are excluded by the terms and 
conditions of this Letter Agreement. Either party will have the right to apply at any time to a 
judicial authority for appropriate injunctive or other interim or provisional relief, and will not by 
doing so be deemed to have breached its agreement to arbitrate or to have affected the powers 
reserved to the arbitrators. The laws of the Commonwealth of Massachusetts, without reference 
to its choice of law principles, go vern this Agreement and any claims arising out of or relating to 
this Agreement, its negotiation, execution, performance, or breach. 
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6. The provisions of this Letter Agreement will be deemed severable, and the 
unerlforceabilhy of any one or more of its provisions will not affect the enforceability of any 
other provision. If any provision is unenforceable, the parties will substitute an enforceable 
provision that preserves the original intentions and economic positions of the parties to the 
maximum extent legally possible. 

7. Any provision of this Letter Agreement that imposes or contemplates continuing 
obligations on a party will survive the expiration or termination of (his Letter Agreement, 
including but not limited to the provisions with x*cspcct to protection of Confidential Information, 
the limitation of liability, waivers, representations, nonsolicitation of employees, and dispute 
resolution. 

8. Without Logicworks’ prior written consent, CGI may not; (A) use any portion of the 
Interim Hosting Services in a live environment or to perform any production activities that affect 
internal or external users or third parties, (B) copy, decompile, reverse assemble or otherwise 
reverse engineer any software component of the interim Hosting Services, (C) remove or alter 
any of the copyright notices or other proprietary markings on any component of the Interim 
Hosting Services, (D) use the Interim Hosting Services for any application where a failure of the 
Interim Hosting Services could result in death, serious injury, environmental damage or property 
damage, e.g., in connection with medical life support devices, water treatment facilities, nuclear 
facilities, weapons systems, chemical facilities, mass transportation, aviation and flammable 
environments, or (B) attempt to discover and/or reuse any Logicworks' license key or licensing 
data. 

J 

9. Logicworks has the right to perform scheduled maintenance from 9:00 p.m, to 6:00 a.m. 
at the location where the maintenance is being performed (a “Maintenance Window”) With prior 
approval 24 hours in advance from CGI, and to perform emergency maintenance at any time 
with notification to CGI in advance of the emergency maintenance event. 

10. This Section 10 is Logicworks’ Service Level Agreement (the “Service Level Agreement” 
or “SLA”) for the Interim Hosting Services, which sets forth CGI’s sole remedy for Logicworks’ 
failure to provide the Interim Hosting Services and for any deficiency in the Interim Hosting 
Services. Except as otherwise provided in this Letter Agreement, Logicworks guarantees that the 
Interim Hosting Services will be available one hundred percent (100%) of the time. For each 
hour that the Interim Hosting Services cannot be accessed from the Internet or are not functional 
(“Downtime”), CGI will be entitled to receive one hour of service credits (“Service ■Credits*’), 
Service Credits are not available for Downtime caused by: (1) maintenance, emergency 
maintenance, or a suspension of services; (2) Haws in CGI’s Content; (3) the incompatibility of 
any operating system. Application or vendor-supplied security patches with CGI’s Content; (4) 
acts or omissions of CGI or agents of CGI, including all testing of the Interim Hosting Services 
by CGI or a third party; (5) the failure of servers or services outside of the datacenter in which 
the Interim Hosting Services are provided, including, but not limited to, inaccessibility on the 
public Internet; (6) Logicworks’ blocking of Content that Logicworks deems to he in violation of 
the AUP; (7) a force majeure or events not in Logicworks’ direct control; (8) a denial of service 
attack, unauthorized access ( i.e., hacking) or malware; (9) CGI’s failure to meet the terms and 
conditions of this Letter Agreement; (10) the use of a shared device by another client of 
Logicworks; and (12) the disabling of Logicworks’ administrative access to the Interim Hosting 
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Services. 


a. For the purpose of determining Service Credit availability, Downtime will be 
measured from the first to occur of the following: (1) CGI’s submission of a service 
request claiming Downtime to Logicworks- Network Operations Center (“NOC”) through 
LogicOps or by placing a direct telephone call to NOC; or (2) the detection of Downtime 
by Logicworks’ monitoring systems. Logicworks will, determine, in its reasonable 
discretion, CGI’s eligibility for Service Credits and tire amount of Service Credits 
awarded pursuant to this Agreement. To be eligible for Service Credits, CGI must send a 
reasonably detailed, written request for Service Credits to Logicworks within five 
Business Days after the first day on which the events giving rise to the request first 
occurred. Logicworks will use reasonable efforts to respond to all Service Credit 
requests within thirty days of receipt. The calculation of all Service Credits will be based 
on Logicworks’ records and data. Logicworks will apply Service Credits to the invoice 
for the month immediately following the month in which a determination of Service 
Credit amount and eligibility is made, If the parties enter into a master services 
agreement, any Service Credits that would be available but for the fact that no future 
invoice will be issued under this Letter Agreement will be carried over to that subsequent 
agreement and applied to the invoice for the month immediately following the month in 
which Logicworks’ determination is made. “Business day” means Monday through 
Friday, except U.S. bank holidays, The maximum combined amount of all Service 
Credits earned in a given calendar month may not exceed the recurring fee for the 
calendar month in which the Service Credits are awarded. CGI is not entitled to excess 
Service Credits that would be available if not for this limitation. 

11, CGI shall implement security measures that are commercially reasonable for its use of the 
Interim Hosting Services. CGI is responsible for maintaining the secrecy of all information 
required to access the Interim Hosting Services (e.g., passwords and usernames). CGI shall 
pay Logicworks for all Interim Hosting Services accessed through its account, including all 
fees resulting from unauthorized use, except where the unauthorized use results from (A) 
Logicworks’ breach of this Agreement, or (B) Logicworks’ failure to notify CGI within one 
hour after Logicworks’ system monitoring tools detect and trigger an alert in response to 
unauthorized access to the Interim Hosting Services. In lieu of tire notice procedures set 
forth below in Section 15, Logicworks may notify CGI an unauthorized access alert either 
through LogicOps or by sending an email to patrick.colacicco@cgi,com . Logicworks will 
measure bandwidth usage at the public Ethernet ports on CGI’s firewalls. Bandwidth 
calculated using the 95th percentile method will be billed to the nearest Mbps, Bandwidth 
usage will reset to zero at the end of each calendar month and will not be carried over to the 
following month. 

12. Logicworks shall maintain and enforce security procedures with respect to its provision 
and maintenance of the Interim Hosting Services that are at least equal to industry standards for 
hosting application development servers that do not store or process Fit and that are in 
accordance with all laws and regulations that apply to Logicworks in the performance of its 
obligations under the Letter Agreement, Logicworks will periodically test its systems for 
potential areas where security could be breached. Logicworks will report to CGI immediately 
any breaches of security or unauthorized access to Logicworks’ systems that Logicworks delects 
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or becomes aware of. CGI shall implement security measures that are commercially reasonable 
for its use of the Services, 

13, Warranties and Disclaimers. 

a. CGI warrants that Contract Data as defined below will not be transmitted to or 
processed or stored on the Interim Hosting Services. “Contract Data”, as used in this 
Letter Agreement, shall refer to any information, whether oral, written, or electronic, that 
constitutes: 


1, personally identifiable data, including without limitation: 

* “personal information” (as defined in Mass, Gen. Laws ch. 93H), 

* “protected health information” (as defined under the Health Insurance 
Portability and Accountability Act Privacy and Security Rules defined 
below), 

* “personal data” (as defined in Mass, Gen. Laws. ch,66A); 

2, “other slate or federal agency sensitive or confidential data” protected under state 
or federal data security or privacy laws or agreements (which may include personally 
identifiable data from state or federal agencies including, but not limited to, the US 
Internal Revenue Service, Social Security Administration, or Massachusetts 
Department of Revenue)(e.g„ adjusted gross income, number of dependents, 
bankruptcy information, tax information, banking account numbers and routing 
information); and/or 

3, any “de-identified data” (i.e., any personal information, protected health 
information, personal data or other state or federal agency sensitive or confidential 
data from which personally identifiable information has been removed so that there is 
no reasonable basis to believe that the information can be used to identify an 
individual) or “masked data” (i.e., personally identifiable data for which certain data 
elements have been obscured or masked so that there is no reasonable basis to believe 
that the masked information can be used to identify an individual) 

b. CGI represents and warrants that it has obtained all consents and licenses required 
for both parties to legally access and use software that is not provided by Logicworks 
without infringing any ownership or intellectual property rights. 


c. Logicworks represents and warrants that it will provide lire Interim Hosting 
Services in a workmanlike arid professional manner. Except as provided in the previous 
sentence and the Service Level Agreement, all goods and services are provided “AS-IS”, 
Notwithstanding the foregoing, CGI’s use. of any Logic works-provided third-party 
software is governed by the terms of any license or other agreement between CGI and the 
third party software provider. Except as expressly provided in this Letter Agreement, 
Logicworks and its network service suppliers disclaim all other warranties, express and 
implied, including the warranties of merchantability, fitness for a particular purpose, non- 
infringement, title, and any warranties arising from a course of dealing, usage or trade 
practice. 
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d. Neither Logicworks nor its network service suppliers warrant that the Interim 
Hosting Services will be uninterrupted, error-free, completely secure, or that all defects 
will be corrected, CGI acknowledges that Logicworks does not control or monitor the 
transfer of data over telecommunications facilities, including the public Internet, mid that 
Internet accessibility carries with it the risk that privacy, confidential information and 
property may be lost or compromised. 

14. Logicworks’ Acceptable Use Policy posted a! 

http;//www.logicworks,net/acceptableuse.phn on the effective date of this Agreement and 
attached hereto as Exhibit C, as it may be amended from time to time by Logicworks, and as it 
may be made available by Logicworks on any successor or related site (the “AUP”), is 
incorporated herein by reference and deemed a written part of this Letter Agreement, 
Notwithstanding the foregoing, Logicworks may only amend the AUP on at least thirty days’ 
notice and as required in order to ensure compliance with changes in state or federal laws or 
regulations relating to the Interim Hosting Sendees, new or emerging security threats, or to 
protect the health and security of its network, 

15. Logicworks’ technical policies and requirements in Exhibit D are incorporated herein by 
reference and deemed a written part of this Letter Agreement. 

16. In addition to the other terms in this Agreement, CGI’s use of any Microsoft® product is 
governed by the terms and conditions of the Microsoft Addendum located at 
http:Amvw.logicworks.net/legal/microsoft-software-adclendum and attached hereto as Exhibit E, 
as it may be amended by Logicworks from time to time, and as it may be made available by 
Logicworks on any successor or related site. Notwithstanding the foregoing, Logicworks may 
only amend the Microsoft Addendum on at least thirty days’ notice and only as required by 
Microsoft. 

17. Logicworks’ responsibility matrix in Exhibit F is incorporated herein by reference and 
deemed a written part of this Letter Agreement, 

18. For any notice under this Letter Agreement to be valid, it must be sent by one of the 
following methods of delivery: (i) personal delivery; (ii) registered or certified mail, in each case 
return receipt requested and postage prepaid; or (iii) nationally recognized overnight courier, 
with all fees prepaid. For a notice under this Agreement to be valid, it must also be addressed as 
follows: 


If to Logicworks: 


If to CGI: 
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Logicworks Systems Corporation 
155 Avenue of the Americas 
Fifth Floor 

New York, NY 10013 
Attn: Kenneth L, Ziegler 

CGI Technologies and Solutions Inc, 

11325 Random Hills Road, 7 lh Floor 
Fairfax, VA 22030 

Attn: Patrick J. Colacicco, Vice President, Consulting 
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Subject to this Section 18, a notice under this Letter Agreement is effective when received. A 
notice will be deemed received when delivered in person or signed for by the recipient as 
indicated by the signed delivery receipt. If the receiving party refuses to accept delivery, or if 
delivery is impossible because of a change in address for which no notice was given, notice will 
be deemed received upon the rejection or inability to deliver. If a notice is received at the 
location specified in the receiving party’s address in this Section 18 after 5:00 p.m., or on a day 
other than a Business Day, notice will be deemed received on the following Business Day. 

19. Force Majeure, Neither party shall be liable for any damages for delays or failure in 
performance under this Agreement caused by acts or conditions beyond its reasonable control, 
without its fault or negligence, which could not have reasonably foreseen or prevented by 
reasonable precautions. Such acts or conditions (each a ‘‘Force Majeure”) shall include, but not 
be limited to: acts of God or of the public enemy; civil war; insurrections or riots; acts of war; 
acts of government; acts of terrorism; fires; floods; storms; explosions; earthquakes or accidents; 
unusually severe Weather; epidemics or public health restrictions; strikes or labor troubles 
causing cessation, slowdown or interruption of work; and other similar events, or any event 
referred to above preventing a subcontractor from performing its obligations under a 
subcontract. In the event of a Force Majeure, (i) the party experiencing the Force Majeure shall 
exercise due diligence in endeavoring to overcome any Force Majeure impediments to its 
performance and shall provide prompt notice to the other party of the Force Majeure; and (ii) the 
time for performance shall be extended by a period equal to the delay caused by the Force 
Majeure and, if warranted, the fees payable to Logicworks shall be equitably adjusted. 

20. This Letter Agreement and it Exhibits constitute the entire agreement between the parties, 
and supersede ail other prior or contemporaneous communications between the parties (whether 
written or oral), and all other communications relating to the subject matter of the Letter 
Agreement. The Letter Agreement may be modified or amended solely in a writing signed by 
both parties. The parties agree (hat any pre-printed terms contained in purchase orders, 
acknowledgments, shipping instructions or other forms, or invoices, that are inconsistent with or 
different from the terms of the Letter Agreement will be void and of no effect even if signed by 
the party against which their enforcement is sought. This Letter Agreement will be construed 
and interpreted in a neutral manner. No rule of construction or interpretation will apply against 
airy particular party based on a contention that the Letter Agreement was drafted by one of the 
parties. The word “including” is a term of expansion, not limitation. Unless otherwise indicated, 
all references to a day are references to a calendar day and all references to a time of day are 
references to the time in New York, N, Y, If any date specified in this Agreement as the only day, 
or the last day, for taking action falls on a day that is not a Business Day, then that action may be 
taken on the next Business Day. A fully signed copy of this Letter Agreement made by reliable 
means (i.e., a facsimile or electronic image) will be considered an original. 


Letter Agreement 10 Confidential arid Proprietary 

CGI - Logicworks September 19,2012 

.aooiMiivJ 



Exhibit B - Service Order 


Letter Agreement 1 ] Confidential and Proprietary 

CGI - Logicworks September 19,2012 



logicworks 
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Public. Privo te. Hybrid. 



Setup Fee 


Client Name: CGI Technologies and Solutions Inc. 
Billing Address: 1132S Random Hills Road, ?th floor 
City, Stale, Zip: Fairfax, VA 22030 


Contact Person; lanWipporman 

Contact Phone: 703-462-0070 

Contact E-Mail: Jan.wipperman@icgi.corn 


Date: 08/17/12 

Account Executive: Zeller, Steven 

Service Order No: 1041138 

Service Order Expires: 09/01/12 


Setup / Installation 


::ZQty Sefvkn4-?S:M-i; '. -i T 

sag , . m ^gHOHBSMBS 

3 

i 

I 

1 Setup/Installation 

S3,500 $ 

3,5Q0>00 


Subtotal Managed Network: $ 

3,500.00 


Total Setup Fee: $ 

3,500.00 

_ _ /^\ __ 

(One-Time Non-Recurring Cost) 



Date: *7 ''•$£) ~IX 


Print Name: P/^iti s Cdt) 

Title: 
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Monthly Recurring Service Order 



Client Name: CGI Technologies and Solutions Inc. 

Billing Address: 11325 Random Hills Road # 7?h Floor 

City; State, Zip: Fairfax, VA 22030 

Contact Person: Jan Wipperrhan 

Contact Phone: 703*462*0070 

Contact' E-Mail: jan.vvipperman@cgi.com 

Date: 08/17/12 

Account Executive: Zeller, Steven 

Service Order No: 1041138 

Service Order Expires: 09/01/12 

Managed Network 


®MQty 

Service ■ ■ - - 

Unit Price,vtpSExten'ded'J'rice .- - 

. . >» !;»} 

._ Hewlett Packard Gb Ethernet switches provide top-of-rock connectivity and 1 

indicated for billing purposes..(Bandwidth overage is available at $ 30/Mbps) 

Gb throughput. Bandwidth is non-copped ond 

1 

5 

HP ProCurye 2510G 24-pari 

Bandwidth Mhps (95th%ile) 

$ 315,00 $ 315,00 

$ 24.00 $ 120,00 



Subtotal Managed Network: $ 435.00 

Managed Dedicated Firewalls 


f : tQW 

: i - /Service 

. f\.v YY ilhitlPricejj ■ ' EslenrieSiPrlcS 

1 

Linux iPTobies Firewall 

Dedicated Firewall Server 

$ 295.00 $ 295.00 



Subtotal Managed Dedicated Firewalls: $ 29S.00 

Managed Backups a Storage 


g® Utv 


• Unit Price'/ t>teiVdad;prir.e 

r t 

EMC Isilon NAS Storage 


2300 

ISilon Network Attached Storage (G8) 

$ 1.00 $ 2,300.00 



Subtotal Managed Backups 8 Storage: $ 2,300.00 

Managed Virtual Servers 


tiiiStv:/- 

-Service 

7 ■ ^I^SlB^fe^iscSiitigie^SpSxtliideclfPrfcK* 

O; 

Managed virtual servers include VMv/ore CSX and Red Hot enterprise Linux. Servers ore imaged with 
monitoring, backup, and management taels included. Red Hal Virtual Servers run on dedicated 

VMivore CSX physical hosts including full redundancy and fail-over capabilities; VMotion, VSphere, and 

Storage VMotion. 

23 

Managed Private Virtual {Redhat ES) 

5 95.00 $ 95.00 $ 2,185.00 



Subtotal Managed Virtual Servers: S 2,185,00 

Private Cloud Host Servers 


SffiQW 

Service 



:& __ Logicworks' fully managed database servers are designed, configured and monitored by our DBAs 2A/7/3b5, 


3 Host S 1,207,00 $ 3,621.00 

Sbav 2.5" SAS 111 server chassis 
2x X5660 2,80GHz Hex-Core processor^) 

96GB 0083-1333 ECCREG (868x12 - 2 cpu) ram 
2x 150GB 10K 2.5" SATA disks 
UIO Raid Card w/baltery 
























logicworks 

The Cloud Your Way 
Public. Privo te. Hybrid. 



Monthly Recurring Service Order 


Dual-Port Gigabit Ethernet card 
Vmware £$X 
Managed ESX Services 


Subtotal Managed Dedicated Servers: $ 3,621,00 


Total Monthly Recurring: 
Committed Term: 


S 8,836.00 

MTM 


The person signing belovr represents that he or she is authorized to sign this Service Order on behalf of Client, 


Client: 


CGI Technologies and Solutions Inc, 
11325 Random Hills Road, 7th Floor 
Fairfax, VA 22030 


And that Client accepts this Service Order subject to the terms of the Letters of Intent between Logicworks and University of Massachusetts 
Medical School dated August ifith, 2012, and between Logicworks and CGI Technologies and Solutions Inc, dated August 1 Vth, 2012, Client 
also accepts the terms & conditions specified in: 

Logicworks Acceptable Use Policy: http://www.logicworks.net/acceptabie-use-policv 
logicworks Responsibilities Matrix: htto://www.logicworks,net/responsibilities 
Logicworks Technical Policies: http://www.Lbgicworks.net/policies 


Signature: 



Date: 'f 


csa gap 


Title 


t ulce 


g r 


Print Name: 










Exhibit C - Acceptable Use Policy 

1. General. This Acceptable Use Policy sets forth guidelines for tire acceptable use of 
Logicworks' network. All Subscribers to Logicworks' services are required to comply with this 
policy. 

2. Illegal Use. The Logicworks network may only be used for lawful purposes. Transmission, 
distribution or storage of any material in violation of any applicable law or regulation is 
prohibited, This includes, without limitation, material protected by copyright, trademark, trade 
secret or other intellectual property right used without proper authorization, and material that is 
libelous, defamatory, constitutes an illegal threat, violates export control laws or regulations or 
encourages conduct that would constitute a criminal offense or give rise to civil liability. 

3. System and Network Security. Violations of system or network security are prohibited. 
Examples of system or network security violations include, without limitation: 

a. Unauthorized access to or use of data, systems or networks, including any attempt to probe, 
scan or test the vulnerability of a system or network or to breach security or authentication 
measures without express authorization of the owner of the system or network 

b. Unauthorized monitoring of data or traffic on any network or system without express 
authorizat ion of the owner of the system or network 

c. Interference with service provided to any user, host or network including, without limitation, 
mailbombing, flooding, computer worms or viruses, deliberate attempts to overload a system and 
broadcast attacks and 

d. Forging of any tep-ip packet header or any part of the header information. 

4. Abuse. The following acts are considered to be abusive of the Logicworks network and are 
prohibited: 

a. Any conduct which violates the accepted norms and expectations of the Internet community at 
large including, without limitation, posting or distributing information or materials which are 
abusive or threatening. Logicworks reserves the right determine, in its sole discretion, whether 
any particular conduct violates such norms and expectations 

b. Resale of any Logicworks services or products unless expressly authorized in writing by 
Logicworks 

c. Falsifying. Subscriber information in applications, contracts and other materials provided to 
Logicworks including fraudulent use of credit card numbers or "bill to" numbers 

d. Falsifying identity or contact information to circumvent this Acccplable Use Policy or 
otherwise 

e. Forging of message headers or a sender's identity, or taking any similar action with the intent 
of bypassing restrictions or limits on access to a specific service or site 

f. Creating, forwarding, posting or distributing chain messages of any type (also known as 
"pyramid" or "ponzi" schemes) and 

g. Attempting to circumvent or alter the processes or procedures to measure time, bandwidth 
utilization or other methods to document use of Logicworks services. 

5. E-mail. Logicworks prohibits Subscribers from engaging the following e-mail related 
activities: 
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a. Sending unsolicited bulk e-mail ("UBE", or "SPAM"). This includes bul ls not limited to the 
distribution of UBE for commercial, informational, advertising, political, or religious purposes 

b. Setting up "mailback" or "drop box" addresses in order to receive responses from UBE, either 
directly by the Subscriber or by a third party on behalf of the Subscriber and 

c, Engaging in any of the foregoing activities by using the service of another provider, but 
channeling such activities through a Logicworks account, remailer, or otherwise through a 
Logicworks service or using a Logicworks account as a mail drop for responses or otherwise 
using the services of another provider for the purpose of facilitating the foregoing activities if 
such use of another party's service could reasonably be expected to adversely affect a 
Logicworks service. 

d, Running a mail server with open relay, i.e, which allows the unchallenged forwarding ofe- 
mail. Logicworks reserves the right to implement technical mechanisms which block UBE 
before it is forwarded or otherwise sent to its intended recipients, 

6. Compromised Servers or Network Equipment. Logicworks prohibits the continued 
Operation of servers that have been compromised by third parties or automated agen ts, 

7. World Wide Web. Logicworks prohibits Subscribers from engaging in any of the following 
web-related activities: 

a. Exploiting or attempting to exploit any scripts presented on a web page 

b. Utilizing programs, scripts or commands to abuse a web site, e.g. by using bandwidth 
excessively and 

c. Hosting a web page which acts maliciously against users that visit that page. 

8. Indirect Violations. INDIRECT OR ATTEMPTED VIOLATIONS OF THE POLICY, AND 
ACTUAL OR ATTEMPTED VIOLATIONS BY A THIRD PARTY ON BEHALF OF A 
SUBSCRIBER OR A SUBSCRIBER'S END USER SHALL BE CONSIDERED VIOLATIONS 
OF THE POLICY BY SUCH SUBSCRIBER OR END USER. 


9. Reporting. Subscribers to Logicworks’ services are required to immediately report to 
Logicworks (i) any event or issue which could compromise the stability, service or security of 
the Logicworks network and (ii) any.known violation of this Acceptable Use Policy. 

10. Consequences of Non-Compliance, Violation of this Acceptable Use Policy is strictly 
prohibited. In the event of any actual or potential violation, Logicworks reserves the right to (i) 
suspend or terminate, either temporarily or permanently, any or all services provided by 
Logicworks to Subscriber, (ii) block and/or filter any abusive activity or (iii) take any other 
actions as deemed appropriate by Logicworks in its sole discretion. Nothing contained in this 
policy shall be construed to limit Logicworks' actions or remedies in any way with respect to any 
violation of this Acceptable Use Policy. Subscribers who violate this Acceptable Use Policy may 
incur criminal or civil liability. Logicworks may refer violators to civil or criminal authorities for 
prosecution and will cooperate folly with applicable government authorities, 

11. Changes to Policy. Logicworks reserves the right to modify this Acceptable Use Policy at 
any time without notice, A current version of the policy is posted on Logicworks' web site at 
www.logicworks.net/acceptable-use-poliev . 
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12, Complaints/Questions, Complaints or questions regarding this Acceptable Use Policy 
should be sent to abuse@Logicworks.net . 


Letter Agreement 14 Confidential and Proprietary 

CGI - Logicworks September 19, 2012 

00036233v3 


Exhibit I) - Responsibilities Matrix 
LOGICWORKS RESPONSIBILITY MATRIX 

This Responsibility Matrix describes responsibilities that are included in the Letter Agreement 
with Logicworks and it identifies which party must perform them. The responsibilities described 
in this Responsibility Matrix are not exhaustive, and they are in addition to the other terms and 
conditions in the Letter Agreement with Logicworks. Each parly shall perform the 
responsibilities assigned to it in the applicable sections of this Responsibility' Matrix. Capitalized 
terms that are not defined herein, including the term "Agreement", have the meanings given them 
in the Letter Agreement, Acceptable Use Policy, Tech Policies, Service Order, or any addendum 
thereto. 

1. MANAGED SERVICES AND MANAGED SERVERS. The following responsibilities in this 
Section 1 of the Responsibility' Matrix apply exclusively to managed physical servers, managed 
Virtual Servers, managed devices, and managed Services that are specified on a Service Order 
and purchased under the Letter Agreement. 


Facilities 

Logicworks 

CGI 

Provide Power, backup power, I-IVAC, 24x7 physical security, video 
surveillance, biometrics, fire suppression 

X 

H 

Provide Internet access via multiple upstream providers with BGP 

X 

1 1 

Maintain insurance for colocated equipment, if any 


9M 


Provisioning 

i wrrngtsygiTa^HW 


Ensure that the Configuration, as specified, is sufficient to meet CGI’s needs, 
including performance 


X 

Build the Configuration 

X 


Provide CGI with the use of the Configuration 

X 


Execute upgrades or modifications to the Configuration as directed by CGI 

X 


Comply with Logicworks Tech Policies regarding the deprecation of 
hardware and/or software 


■ 

For every Eligible Application, maintain redundant hardware of equal 
specifications for all constituent servers and devices 


X 


Monitoring and Response 

Logicworks 

CGI 

Moni tor the availability of servers and devices 24x7x365 

X 


Replace defective hardware within 1 hour of diagnosis by Logicworks 

X 


Before going live, set up health check tests, in conjunction with Logicworks, 
to determine application health and availability 


X 

Monitor for application health and availability pursuant to CGI’s written 
instructions 

X 


Before going live, provide a detailed written description of all monitoring, 
alerting, notification and response procedures 


■ 

Implement emergency failover procedures that are developed by CGI and 
provided to Logicworks in writing upon the occurrence of a detected failure 

X 
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Facilities ______.... 

Provide up-to-date contact information via LogicGps for contact 
authorization, monitoring, alerting and response procedures, including an up- 
to-date contact distribution list with specific response and escalation 

instructions for complex contact protocols with numerous parties __ 

Notify Logicworks and other non-Logicworks authorized contacts oi any 
maintenance that may result in application unavailability or system alerts _ 

Security' and Patching _ _Logicworks 

\pply critical security updates (e.g., patches addressing vulnerabilities that x 
llovv remote root or Administrator exploits) through announced emergency 

maintenance _______________________ 

Apply quarterly critical security patches through planned maintenance with x 

4 hours' notice _____ , 

Manage firewalls and implement access changes as requested by authorized x 

CGI contact in writing _____ 

Maintain and follow security procedures as specified in Logicworks' SAS70 x 

Type 11 audit ______________________________ 

Follow generally accepted security practices for the administration of 
-testing Equipment . ______ 




Administration and Support 


|Logic\vorks |CG1 


Provide 24x7x365 Network Operations Center support via telephone, Web x 
and email ___ 


Provide emergency (i.e., application down) support 24x7x365_____ 


Provide systems, network, and security administration, which includes the 
following: (1) operating system installation, maintenance and upgrading; (2) 
responding to Trouble Tickets and alerts; (3) performing routine network 
administration and maintenance; (4) systems database administration to 
ensure high-availability: (5) replacing failed Hosting Equipment; and (6) 
maintaining a LogicOps client portal 

Request off-peak, non-emergency maintenance 48 hours in advance_ 


Develop, maintain and support all CGI applications and Content, including 
tuning services upon which CGI Application is dependent (e.g, Apache) 
Maintain the compatibility of all CGI Applications and Content with O/S 
version and version upgrades _ 



Backup and Restoration __ 


Schedule a daily backup of CGI servers for data recovery_ 


Copy and/or move data off-site on a weekly basis 

Initializing restoration request within 1 hour of receipt__ 


Manually re-attempt backups within 24 hours of receiving backup failure X 

alert ___ _ 

Maintain sufficient committed backup storage space tor a minimum of 2 
restore points per server_ 


Logicworks CGI 
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Facilities 


Determine backup storage requirements on a per server basis based on days 
retention required 


Notify Logicworks of ail changes to a server that may affect backups, e.g,, a 
change in partitions, etc. 


Configure custom backups for data contained in files held open by the 
operating system, including database files . 


Managed Database and Storage Services 


Provide the requisite licensing information for all CGI-owned Applications, 
including all Applications for which CGI has independently obtained use or 
ownership rights 


Install each Application on a minimum of two servers 


Assist CGI in configuring Managed Services, including data replication 
etween servers 


Specify, in writing, all custom failover procedures that Logicworks will 
follow if a component of High Availability Hardware fails 


Upon written request, assist CGI in configuring automated failover 
procedures for Managed Services which are capable of automatic failover 


pon written request, assist CGI in developing manual failover procedures 
where Managed Services do not have the capacity for an automatic failover 


Test written failover procedures for all High Availability Hardware and all 
Virtual Servers, except for shared devices, prior going live (making CGI 
pplications available to end users) 


olify Logicworks of any changes made to the Configuration (e.g., the 
addition of a new partition on a storage server or a new database on a 
database server) 


Test written failover procedures immediately after any changes are made to 
the Configuration 


Sotify Logicworks in writing of any changes in the architecture of C’Gl's 
Configuration that may impact high-availability or monitoring & response 
(e.g., changing the Servers on which an Applications runs or integrating an 
additional Server into the active hosting architecture) within 24 hours of 
making that change 


Logicworks 












Managed Template Service 


Provide 'an initial Virtual Server OS template that is eligible for management 
Modify Virtual Server template for integration into CGI's Managed Services 

where applicable (e.g. managed database services) _ 

Modify Virtual Server launched from an eligible template to work with CGI 
Application and Content 


Create template of Virtual Server that has been customized by CGI upon 

r eceiving notification from CGI by email or through LogicOps _ 

pply critical security updates (e.g., patches addressing vulnerabilities that 
[allow remote root or Administrator exploits) to CGI's most current version of 
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Facilities 


a Virtual Server Template through announced maintenance 


Apply quarterly critical security patches to CGI's most current version of a 
Virtual Server Template through planned maintenance with forty-eight (48) 
hours' notice 


otify Logicworks of the need to create a new or modified Virtual Server 
template that incorporates any chances made by CGI 


Arrange and conduct testing of each new or modified Virtual Server template 
with Logicworks to ensure correct functioning upon deployment 


Deploy production Virtual Servers from tested Virtual Server templates as x 
Manned maintenance to be scheduled no less than 24 hours in advance 


Store Virtual Server Templates for deployment 


Logicworks jCGI 



otify Logicworks through LogicOps of any change in CGI's login 
5assvvord(s) and orally provide the new password to Logicworks 


Notify Logicworks by email or through LogicOps of the existence of any 
external dependencies on API keys 



2. CLOUD 1NFRASTRU CTURE. The following responsibilities in this Section 2 of the 
Responsibility Matrix apply exclusively to the Cloud Services. 


Facilities 

Logicworks 

CGI 

Provide Power, backup power. HVAC, 24x7 physical security, video 
surveillance, biometrics and fire suppression 

x 


Provide Internet access via multiple upstream providers with BGP 

X 

■ 


Infrastructure and Support 

flSgBHTOTHI 

CGI 

Execute upgrades and maintenance (o the Infrastructure 

X 


Provide 24x7x365 availability of Infrastructure, excluding maintenance 
windows 

X 

■ 

Monitor compute node and storage layer health 

X 


Notify CGI of maintenance that may result in unavailability of the 
Infrastructure or Cloud Servers on a specific compute node 

X 


Confirm that high availability failovers execute properly in the event of 
isolated compute node failures 

X 


Provide online Support through Logicworks' Cloud Services Website, 
including documentation and forums 

X 



3, UNMANAGED VIRTUAL SERVERS, The responsibilities in this Section 3 of the 
Responsibility Matrix apply exclusively to Cloud Services and to all other Virtual Servers that 
are not specified as managed in a separate Master Service Agreement signed by us, 
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Security 



Follow generally accepted practices for network security and server 
administration 



Apply critical security updates for applications and operating systems on 
virtual machines 


X 


Virtual Machines and CGI Content 

85*35 


Ensure that necessary services start automatically upon a server reboot 


X 

Configure and manage backups and restoration of Virtual Machines through 
snapshots and/or create and maintain a current backup copy of all 
configurations and content outside of the Cloud Services 


X 

Configure and manage snapshots and utilize them for redeployment and 
restoration as necessary 


X 

Provide the requisite licensing information for all CGI-owned Applications, 
including all Applications for which CGI has independently obtained use or 
ownership rights 



Develop, maintain and support all CGI Applications and Content 


X 
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Exhibit E - Microsoft© Software Addendum 

This document concerns CGI’s (“you” or “your”) use of Microsoft software, which includes 
computer software provided to you by Logicworks Corporation (“Logicworks”) as described 
below, and may include associated media, printed materials, and “online” or electronic 
documentation (individually and collectively “Software Products”). Logicworks does not own 
the Software Products and the use thereof is subject to certain rights and limitations of which 
Logicworks needs to inform you. Your right to use the Software Products is subject to the Letter 
Agreement, and to your understanding of, compliance with and consent to the following terms 
and conditions, which Logicworks does not have authority' to vary, alter or amend. 

1. DEFINITIONS. 

(a) “Client Software” means software that allows a Device to access or utilize the services or 
functionality provided by the Server Software. 

(b ) “Device” means each of a computer, workstation, terminal, handheld PC, pager, telephone, 
personal digital assistant, “smart phone,' or other electronic device. 

(c) “Server Software” means software that provides services or functionality on a computer 
acting as a server. 

2. OWNERSHIP OF SOFTWARE PRODUCTS. The Software Products are licensed to 
Logicworks from an affiliate of Microsoft Corporation (“Microsoft”). All title and intellectual 
property rights in and to the Software Products (and the constituent elements thereof, including 
but not limited to any images, photographs, animations, video, audio, music, text and “applets” 
incorporated into the Software Products) are owned by Microsoft or its suppliers. The Software 
Products are protected by copyright laws and international copyright treaties, as well as other 
intellectual property laws and treaties. Your possession, access, or use of the Software Products 
does not transfer any ownership of the Software Products or any intellectual property rights to 
you. 

3. USE OF CLIENT SOFTWARE. You may use the Client Software installed on your Devices 
by Logicworks only in accordance with the instructions, and only in connection with the 
services, provided to you by Logicworks. The terms of this document permanently and 
irrevocably supersede the terms of any Microsoft End User License Agreement which may be 
presented in electronic form during your use of the Client Software. 

4. COPIES, You may not make any copies of the Software Products; provided, however, that you 
may make one (1) copy of Client Software on your Device as expressly authorized by 
Logicworks. 

5. LIMITATIONS ON REVERSE ENGINEERING, DECOMPILATION AND DISASSEMBLY. 
You may not reverse engineer, decompile, or disassemble the Software Products, except and only 
to the extent that applicable law, notwithstanding this limitation expressly permits such activity. 

6. NO RENTAL. You may not rent, lease, lend, pledge, or directly or indirectly transfer or 
distribute the Software Products to any third party, and you may not permit any third party to 
have access to and/or use the functionality of the Software Products. 

7. TERMINATION. Without prejudice to any other rights, Logicworks may terminate your rights 
to use the Software Products if you fail to comply with these terms and conditions. In the event 
of termination or cancellation, you must stop using and/or accessing the Software Products, and 
destroy all copies of the Software Products and all of its component parts. 
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8. NO WARRANTIES, LIABILITIES OR REMEDIES BY MICROSOFT. ANY 
WARRANTIES, LIABILITY FOR DAMAGES AND REMEDIES, IF AN Y, ARE PROVIDED 
SOLELY BY LOGICWORKS AND NOT BY -MICROSOFT OR ITS AFFILIATES OR 
SUBSIDIARIES, 

9. PRODUCT SUPPORT. Any product support for the Software Products is provided to you by 
Logicworks and is not provided by Microsoft or its affiliates or subsidiaries, 

10. NOT FAULT TOLERANT, THE SOFTWARE PRODUCTS MAY CONTAIN 
TECHNOLOGY TH AT IS NOT FAULT TOLERANT AND IS NOT DESIGNED, 
MANUFACTURED, OR INTENDED FOR USE IN ENVIRONMENTS OR APPLICATIONS 
IN WHICH THE FAILURE OF THE SOFTWARE PRODUCTS COULD LEAD TO DEATH. 
PERSONAL INJURY OR SEVERE PHYSICAL. PROPERTY OR ENVIRONMENTAL 
DAMAGE. 

11. EXPORT RESTRICTIONS. The Software Products are of U.S. origin for purposes of U.S. 
export control laws. You agree to comply with all applicable international and national laws that 
apply to the Software Products, including the U.S. Export Administration Regulations, as well as 
end-user, end-use and destination restrictions issued by U,S, and other governments. For 
additional information, see http://www.mici'osoft.com/exi)orting/ . 

12. LIABILITY FOR BREACH. In addition to any liability you may have to Logicworks, you 
agree that you will also be legally responsible directly to Microsoft for any breach of these terms 
and conditions. 
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Exhibit F - Logicworks Technical Policies 


Operating Systems 

• Currently, Windows support is limited to Windows 2003 and later. 

» Currently, Linux support is restricted to Red Hat Enterprise Linux 4.0 and later, 

• New hardware may require most recent versions of vendor operating systems due to 
hardware/driver support. 

• While clients may choose to schedule the deployment of Operating System Vendor 
patches, those patches must be applied in a commercially reasonable time frame. 

» Logicworks will not support deprecated hardware and software (e.g., hardware and 
software that is no longer supported by its manufacturer, declared by its manufacturer to 
be “end of life”). Logicworks will not be liable for any loss or damage arising from 
CGI’s use of deprecated hardware or software in connection with the Interim Hosting 
Services, 


Storage 

• System disks are either software mirrored RAID 1 or SSD (solid-state drive). 

• Due to extended array rebuild times and the potential lor failure of a second disk during 
rebuilds, Logicworks supports RAID I and RAID 10 only for storage subsystems. 

• SATA disks are not supported for I/O intensive production servers. Only SCSI or SAS are 
supported for I/O intensive applications. 

• Each server, storage array, or partition (if applicable) shall have adequate space for all 
data files, log files, and backups, and CGI must maintain adequate disk space for 
projected ninety (90) day growth so as to not exceed a threshold of 85% total disk usage. 

« Arrays must contain a hot spare per LUN. 

• Custom partitioning schemes are subject to Logicworks ™ Senior Engineering approval. 

Security & Administration 

» CGI must communicate any changes of a given server's role to Logicworks (e.g., 
installing a database management system on a Web server). 

» Passwords must conform to generally-accepted best security practices, i.e,, must include 
non-alphamtmeric characters, cannot be easily-guessable, and must be greater than 8 
characters. 

» CGI is prohibited from modifying Server configuration in any way that prevents the 
server from rebooting cleanly and/or requiring manual intervention on startup or the 
application from restarting on reboot without manual intervention. 

• Logicworks has sole authori ty of server naming for administrative purposes. 
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« If root or Administrator passwords, for Linux and Windows respectively, are changed, the 
new passwords must be communicated to Logicvvorks immediately. 

• No passwords should be sent via email, If passwords are sent via email, they will need to 
be changed immediately. 

• CGI is prohibited from accessing Websites that are likely to contain malicious code from 
its servers, and are generally discouraged from accessing the Internet from their servers. 

• If CGI intends to use centralized configuration deployment (e,g., Puppet, cfengine), it 
must consult with Logicvvorks Senior Engineering before doing so. 

» CGI may not disable or alter system settings that may affect monitoring, failover, or 
administration (e.g,, ucarp, syslog, cron, sendmail, snmpd for Linux; syslog agent, sump 
service, wrrii service, windows firewall, remote registry for Windows). 

Network 

« Any changes to network configuration are subject to Senior Engineering approval. 

• CGI SNMP access to devices is limited to read-only access to devices on which client has 
shared administrative access. 

• Administrative access to servers must be available on standard ports and allowed from 
Logicvvorks administrative networks. 

• All administrative access (SSH, Remote Desktop, FTP, etc.) must be restricted by IP 
address, or accessed via VPN. 

- While Logicvvorks will communicate to its Internet transit providers any observed 

upstream peering congestion or flapping issues, Logieworks will not be held liable for the 
performance of providers of which it is not a direct customer. 

• All features available in an IOS image feature set (or similar) may not be supported if an 
alternate feature providing the same functionality is available. Changes to currently 
unsupported features are subject to Logieworks Senior Engineering approval, 

Backup and Recovery 

• CGI must Specify per-server allocation of committed backup space. 

• CGI must maintain adequate space per server to accommodate at least two (2) restore 
points, 

•> Database backups must be written to the local file system first, prior to being copied off- 
server, regardless of whether database backups are being performed by a custom agent. 

• Logicvvorks cannot exclude individual files or directories from backups, only partitions, 

• Logicvvorks wifi adjust the number of restore points to conform to the available space 
allocated to each server. 
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High-A vai!ab ility 


• Ai! failover scenarios are subject to testing, coordinated by CGI and Logicworks within 
Logicworks’ normal business hours. Testing must be performed post-turnover and prior to 
going live (i.e., making the Application available to end users). 

• Web servers and.application servers which are dependent on high-availability services 
need to be configured by CGI in accordance with Logicworks' recommended practices. 

• CGI is responsible for providing the appropriate parameters (e.g., thresholds, failover 
conditions, timeouts, etc, set high enough to not cause false failovers) for high 
availability configurations. 

• CGI may not disable or alter system settings that may affect monitoring, failover, or 
administration (e.g., ucarp, syslog, cron, sendmail, snrnpd for Linux; syslog agent, snmp 
service, wmi, database mirroring, clustering, log shipping, recurring jobs configured by 
Logicworks for Windows). CGI may not alter anything that may affect high availability 
services without consulting with Logicworks Senior Engineering in advance. 

Managed Application Sendees 

• Servers for managed application services are single-purpose. 

• CGI is only provided limited access to managed application servers, 

• CGI should only connect to, or have applications connect to, the Virtual IP (VIP) for a 
managed application, not the server's native IP address. 

Managed Database 


• CGI is required to maintain a replica (a standby or secondary) server, whose computing 
power must be equal to the computing power of the primary server or Group (hat is not 
dependent on the block device or storage subsystem of the primary database server, 

• Replica database servers must be used only for reads when not being used as the live 
database in a fail-over scenario. 

• If replica database servers are used for reporting, enough resources must remain available 
for the use of the replica server during a fail-over scenario to not be impacted. CGI 
acknowledges that additional users of replica server may impact performance during 
failover use. 

• CGI shall be required to provide and maintain, in writing, documentation concerning 
requested failover procedures. 

• CGI may be required to maintain separate block devices for log files, data and backups, 
subject to the direction of Logicworks Senior Engineering. 

• Database backups must be written to the local file system first, prior to being copied off- 
server, regardless of whether database backups are being performed by a custom agent. 

« GG1 must maintain sufficient storage space for 2 local copies of database backups. 
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« CGI must notify Logicworks if and when it is perforating manual database failovers. 

• CGI must noli fy Logicworks of the creation of additional databases as those additions 
may affect high-availability, backups, or replication (SQL Server only). 

Hourly Billable Services 

• Services that are billable by the hour must be scheduled in advance. 

» Logicworks is entitled to bill for services to repair servers or applications necessitated by 
CGI’s actions (not including restores). 

• Logicworks is entitled to bill for application configuration beyond standard 
configurations. 

• Logicworks will refer CGI to third-parties for services that it does not perform. 

• Logicworks will not perform hourly services on a monthly recurring basis. 

• Hourly billable services are provided as-is and as specified at time of scheduling. Further 
configuration not included in original scope may be subject to additional fees. 
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logicworks 

LOGICWORKS® MASTER SERVICE AGREEMENT 

This Master Service Agreement (the "MSA") is entered into between LOGICWORKS SYSTEMS CORPORATION 
("Logicworks"), a Delaware corporation, with its principle address at 155 Avenue of the Americas, Fifth Floor, New 
York, NY 10013 and the following client ("Client" or "CGI"): 

FULL LEGAL NAME: CGI Technologies and Solutions Inc. 

STATE OF FORMATION: Delaware 

TYPE OF ENTITY: Corporation 

EMAIL ADDRESS: Patrick.Colacicco@cgi.com 

MAILING ADDRESS: 11325 Random Hills Road, 7 th Floor, Fairfax, VA 22030 

CONTACT PERSON: Patrick Colacicco, Vice President 

Logicworks and Client are also referred to in this Agreement individually as a "party" and collectively as the "parties". 

WHEREAS, The University of Massachusetts Medical School (the "University"), has entered into an 
agreement with CGI for the purpose of implementing and hosting the Massachusetts Health Insurance Exchange (the 
"Prime Contract"); and 

WHEREAS, CGI desires to subcontract to Logicworks the hosting services it has agreed to provide to the 
University on behalf of the HIX/IES Entities under the Prime Contract. 

NOW, THEREFORE, CGI agrees to obtain and Logicworks agrees to provide to CGI the services outlined in one 
or more Service Orders in accordance with the following terms and conditions: 

1. THE AGREEMENT; EFFECTIVE DATE. The following documents are attached as Exhibits to this MSA 
and incorporated herein by reference: 

(a) Exhibit A - Service Orders; 

(b) Exhibit B - Prime Contract Flow Down Terms; 

(c) Exhibit C - Service Level Agreement ("SLA"); 

(d) Exhibit D - Responsibility Matrix; 

(e) Exhibit E - Acceptable Use Policy; 

(f) Exhibit F - Technical Policies; 

(g) Exhibit G - Microsoft Addendum; and 

(h) Exhibit H - RFR. 

The foregoing documents, collectively, constitute the entire agreement between the parties (the "Agreement" or 
"Contract"). This MSA is effective as of December 21, 2012 (the "Effective Date"). 

2. SERVICE ORDERS. The Services (as defined in Section 3) provided by Logicworks and the related fees 

for those Services will be set forth on a service order ("Service Order" or "SO"). Service Orders are issued by 

Logicworks and are not subject to amendment except as provided below in Section 19 (Upgrades). 

3. SERVICES. Logicworks shall provide to Client the hardware, software, operating systems, networking 
equipment, bandwidth, and other products and services described in an SO (collectively, the "Services" or "Hosting 
Services"). Services include all Managed Services described below in Section 10 and all Unmanaged Services 
described below in Section 11. Logicworks may also perform technical services not listed in an SO ("Additional 
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Services"). Additional Services are billed in one-hour increments. The scope and hourly cost of Additional Services 
must be agreed to in advance in writing. 

4. COMMENCEMENT. Unless otherwise agreed in writing, Services will commence when Logicworks 
provides Client with access to the Configuration, or when Logicworks informs Client by email that its Configuration is 
accessible over the Internet and that its password(s) are available (the ''Commencement Date"), Initial billing for 
Services will be on a on a pro rata basis. The Commencement Date for the items designated as *priority*on the 
Service Orders shall be no later than 18 business days from the Effective Date. 

5. TERM. Each component of the Services will begin on its Commencement Date and continue for a 
committed term through September 30, 2014 (the "Committed Term") at the monthly rate set forth in the initial 
Service Order (the "Recurring Fee"). Logicworks and Client may agree to a new Committed Term in a subsequent 
Service Order. In the event any of the HIX/IES Entities desire to continue the Hosting Services beyond the Committed 
Term, Client shall notify Logicworks at least eighty (80) days prior to the end of the Committed Term of its intent to 
continue the Hosting Services beyond the Committed Term. Logicworks and Client shall promptly meet to discuss in 
good faith a mutually agreed renewal period, subject to terms and conditions substantially similar to those set forth in 
this Agreement, inclusive of applicable prime contract flow-down terms. 

6. FEES AND PAYMENT. Client agrees to pay all fees under this Agreement as expressly set out in the 
Service Order. Recurring Fees will begin to accrue on the Effective Date and are invoiced at or around the beginning of 
each month. All fees will be included on Logicworks' monthly invoices, and some fees, such as excess usage fees will 
be invoiced in arrears. Invoices may be delivered (i) electronically by email to subcontractors.ss.crp@cgi.com or (ii) by 
overnight carrier or postal service to CGI Shared Services Accounts Payable, 1350 Rene-Levesque Blvd. W., 15 th floor, 
Montreal, QC H3G 1T4. Invoices must include the applicable CGI contract reference number issued through CGI's 
eProcurement system. Client shall pay each invoice in U.S. dollars within forty-five (45) days from the date the invoice 
is received (the "Invoice Date") without setoff, deduction, or delay, except for fees that are disputed by Client in good 
faith within forty-five days of their Invoice Date and pending Service Credits. Each invoice shall be paid either by wire 
transfer or by check drawn on a U.S. bank. All fees not objected to in writing within forty-five days from their Invoice 
Date will be deemed accurate. Recurring Fees will accrue during a suspension for non-payment or any other reason. 

It is the sole responsibility of Client to provide accurate billing contact information and to notify Logicworks of any 
changes to its billing contact information in accordance with Section 34 below. 

7. TAXES. The University is exempt from federal excise, state, and local taxes; therefore, sales by Client 
to the University are exempt from Massachusetts sales and use taxes. If the University should become subject to any 
such taxes during the term of this Agreement, and that affects Logicworks' tax liability under this Agreement, Client 
shall reimburse Logicworks for any cost or expense incurred. Any other taxes imposed on Logicworks on account of 
this Agreement shall be borne solely by Logicworks. In no event will Client be responsible for any taxes on Logicworks' 
income. In no event will Logicworks be responsible for withholding any sales tax for the sales to CGI. CGI has provided 
a duly executed form ST-5 (Sales Tax Exempt Purchaser Certificate) to Logicworks. Notwithstanding the foregoing, 
should any of the sales be taxable sales, then the parties shall promptly meet to address the corresponding impact. 

8. CONFIGURATION. Client is solely responsible for determining whether the Configuration (as defined 
in Section 43(c) below) is suitable, and whether it meets and will continue to meet its capacity, performance and 
scalability needs. Client is also responsible for the results of implementing any recommendations made by Logicworks 
regarding its individual use of the Configuration. Client is responsible for requesting all required upgrades and 
modifications to the Configuration, including those required to address one or any combination of the following: (A) a 
spike or change in system resource utilization; (B) processing requirements; (C) storage requirements; or (D) hardware 
and software deprecation. Logicworks may request Client to extend its Committed Term as provided in Section 19 
(Upgrades) below when any upgrades are made to its Configuration in order to reduce the price charged to Client for 
additional Services that are added without a term commitment. So that CGI may make the determinations stated in 
this section, Logicworks shall promptly notify CGI when it receives an alert regarding a spike in usage, storage being 
close to capacity, or another alert that was configured and tested jointly by the parties. Such notice will be sent via 
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phone and may also be sent to Client either through LogicOps or by sending an email to iohn.martin@cgi.com with a 
copy to monica.parker@cgi.com, or other email address as Client may later identify to LogicWorks. 


9. ' CONTENT. Client is solely responsible for the selection, compatibility, licensing, accuracy, 
performance, maintenance, and support of all information, software, and data, including any hypertext markup 
language files, scripts, programs, software, applications, recordings, sound, music, graphics, images, applets or 
servlets that Client or its subcontractors or end users create, install, upload or transfer on, from or through the 
Configuration ("Content"). 

10. MANAGED SERVICES. Logicworks offers managed services for database clustering and replication, 
storage, virtualization, and Virtual Server Templates in accordance with the applicable sections of the Responsibility 
Matrix (each, a "Managed Service"). Fees for Managed Services are stated in the Service Order. Client is responsible 
for providing Logicworks with all information necessary to configure and perform the Managed Services. 

(a) LIMITATIONS. Managed Services are only available for applications deployed on redundant 
Hosting Equipment and on at least two Servers, where each Server has an equivalent configuration and is 
capable of independently running the Application. If an Application is on two Servers that share a common 
block device (only one node has write access to the device at a given time), Logicworks may require Client to 
use an additional Server that does not share dependencies with the first and second Servers. Client is 
responsible for determining whether manual failover procedures are required and, if so, Client shall work with 
Logicworks to document them. If Client's Configuration is capable of failing over from one geographically 
distinct Datacenter Facility to another, Client acknowledges that: (1) the rate of transfer between Datacenter 
Facilities is affected not only by its Configuration and Content, but also by external factors, such as latency 
and bandwidth availability; and (2) any Content that has not completed the transfer between Datacenter 
Facilities will be lost in a failover. 

11. UNMANAGED SERVICES. "Unmanaged Services" are Services and Additional Services used by Client 
in connection with any Server on Logicworks' dedicated or shared cloud infrastructure that is not managed. No Server 
is managed unless it is identified and expressly deemed to be managed on a Service Order. No Virtual Server 
deployed on a managed physical Server or on Logicworks' shared cloud infrastructure will be managed, except if that 
Virtual Server is identified and expressly deemed to be managed on a Service Order. Client is solely responsible for its 
use of all Unmanaged Services in accordance with Section 3 (Unmanaged Virtual Servers) of the Responsibility Matrix. 
Logicworks may elect to provide Professional Services in accordance with Section 12 (Professional Services) to assist 
Client with Unmanaged Services. Unmanaged Services may require Professional Services to be migrated to Managed 
Services. The Service Level Agreement set forth below in Section 18 (Service Level Agreement) does not apply to 
Unmanaged Services. 

12. PROFESSIONAL SERVICES. Logicworks may provide engineering services that are requested by Client 
in writing ("Professional Services") as Additional Services (as defined above in Section 3 (Services)). Logicworks will 
provide client with advance notice of the applicable hourly rate, which may vary according to the Professional Services 
provided. Client may request a Service order in writing prior to the commencement of work, or Client's Service 
Delivery Manager, or his/her designee may approve Professional Services to be performed via email. Any estimates 
provided by Logicworks regarding Professional Services, including those relating to costs, results, work hours, or 
commencement or completion dates, are non-binding estimates that are subject to change at any time; provided that 
Logicworks gives notice to CGI before the estimate is reached and subject to further approval by Client. If fees for 
Professional Services exceed the pre-approved amount, Logicworks may suspend work until a sufficient amount of 
fees is approved by CGI. Client may terminate or amend Professional Services at any time by sending a written notice 
to Logicworks, provided that Client shall pay all fees incurred for Client authorized Professional Services prior to 
Logicworks' receipt of Client's notice. 

13. BACKUPS. Logicworks will schedule nightly data backups of Client's Servers to a primary backup 
server. Data on the primary backup server will be replicated to a secondary backup server off-site. The aggregate 
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amount of available backup storage, as specified by Client, will be set forth in a Service Order. Logicworks will adjust 
the number of restore points to the maximum amount of restore points that can be made using the aggregate amount 
of available backup storage. Client shall purchase sufficient backup storage to accommodate at least two restore 
points and shall purchase additional storage as required to maintain that capacity. Logicworks may also require Client 
to dump a database to a local file system prior to backup. Client acknowledges that Logicworks is not responsible for 
backing up open files. Client may independently create and maintain on its own premises a current backup copy of all 
Content stored on the Servers. Clients with Dedicated Backup Servers, defined as servers specifically used for backing 
up Client data, are responsible for purchasing additional Dedicated Backup Servers at alternate Logicworks Datacenter 
Facilities and configuring replication in order to achieve off-site backups. 

14. THIRD-PARTY PRODUCTS. As expressly agreed in a Service Order or Supplemental Addendum, 
Logicworks may provide Client with access to third-party software, operating systems, services, goods, and other 
products (each, a "Third Party Product") through reseller relationships Logicworks has established with third-party 
vendors, and/or Logicworks may provide support to Client relating to those Third-Party Products. LOGICWORKS 
MAKES NO REPRESENTATIONS OR WARRANTY WHATSOEVER REGARDING ANY THIRD-PARTY PRODUCT OR RELATED 
SUPPORT SERVICES AND, AS BETWEEN LOGICWORKS AND CLIENT, SUCH PRODUCTS AND RELATED SUPPORT 
SERVICES ARE PROVIDED "AS IS." Client's use of any Third-Party Product is governed by the terms of any license or 
other agreement between Client and the third party. In some cases, Logicworks may also require Client to agree to a 
Service Addendum that sets forth specific terms and conditions for a Third-Party Product prior to providing access to 
such Third-Party Product. Any such Service Addendum shall be provided to Client for review prior to the deployment 
of any such Third Party Product. Client may elect to accept the Service Addendum, negotiate directly with the Third 
Party Product's licensor (if possible) or decline to use such Third-Party Product. In the event that the Client declines to 
use such Third-Party Product, or the parties cannot reach agreement on such additional terms and conditions, the 
impact of such will be negotiated by the parties in good faith. Logicworks is not obligated to provide support for, and 
is not liable for the results of, any third-party software, operating system, service, good, or other product that Client 
does not procure from or through Logicworks. 

15. SOFTWARE. Logicworks will, only upon prior written authorization from Client, provide Client with 
access to certain software products as part of the Services. LOGICWORKS MAKES NO REPRESENTATIONS OR 
WARRANTY WHATSOEVER REGARDING ANY SOFTWARE PRODUCT OR RELATED SUPPORT SERVICES PROVIDED BY 
LOGICWORKS AND, AS BETWEEN LOGICWORKS AND CLIENT, SUCH PRODUCTS AND RELATED SUPPORT SERVICES ARE 
PROVIDED "AS IS." Client is not granted any title or intellectual property rights in and to any software provided by 
Logicworks, and Client shall use the software provided by Logicworks solely in connection with the Services as 
permitted under this Agreement. Client's knowing acceptance of or use of software provided by Logicworks and 
expressly stated on a Service Order is deemed to be an acceptance by Client of the license or other agreement that 
governs the use of that software. Client shall not: (A) copy any software; (B) remove, modify, or obscure any 
copyright, trademark or other proprietary rights notices that appear on any software or appear during its use; (C) 
reverse engineer, decompile or disassemble any software; or (D) attempt to discover and/or reuse any Logicworks' 
license key or licensing data. In addition to the other terms in this Agreement, Client's use of any Microsoft® product 
is governed by the terms and conditions of the Microsoft Addendum located Exhibit G hereto. If Client uses any 
software on the Configuration that is not provided by Logicworks, Client shall provide Logicworks with copies of 
consents and licenses required for both parties to legally access and use that software without infringing any 
ownership or intellectual property rights. Upon request, Client shall provide to Logicworks evidence that both parties 
may legally use and access any software not provided by Logicworks without infringing any ownership or intellectual 
property rights. Logicworks will immediately notify Client if it determines that the required consents or licenses are 
not provided by Client and Client's failure to provide such shall relieve Logicworks of any obligations under this 
Agreement that are adversely affected by Client's failure to obtain any required consents or licenses, or to promptly 
furnish to Logicworks evidence it has obtained those consents or licenses. 

16. COLOCATION. Pursuant to a Service Order, Client may colocate devices (including VPN, IDS, search 
devices, etc.), or devices included as part of a Sublease Addendum, in a Datacenter Facility. Client may not colocate 
any hardware provided by Logicworks as a part of the Services. Logicworks will only be required to physically install 
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colocated devices in its Datacenter Facilities which includes racking, power, connection to the applicable HIX/IES 
System networking components, bandwidth and remote hands support of Collocated Devices in both the Data Center 
and Hot Site;. Logicworks is not liable for missed Service Metrics, errors, breaches of security or service interruptions 
caused by colocated devices. Logicworks' support for colocated devices is limited to device reboot upon Client 
request. Client acknowledges that: (A) Logicworks' insurance does not extend to colocated devices; (B) Client does 
not have physical access to colocated devices; (C) Client shall procure a replacement for colocated devices that fail; (D) 
Client's use of colocated devices may require Logicworks to provide Additional Services, which will be mutually agreed 
to in writing pursuant to a Service Order, except in emergency situations; (E) Logicworks may require Client to colocate 
all devices in pairs for redundancy and to minimize Downtime in the event of device failure; (F) Client has not been 
granted any real property interest in the Datacenter Facilities and Client has no right as a tenant or otherwise under 
any real property or landlord/tenant laws, regulations or ordinances. 

17. MAINTENANCE. "Maintenance" means modifications, upgrades, patching or repairs made to the 
Configuration or Datacenter Facilities, or the relocation of Client's Servers within or between Datacenter Facilities. 
Logicworks may perform Maintenance during the Scheduled Maintenance period defined in the SLA (a "Maintenance 
Window"), or at any time scheduled by the parties. Notwithstanding the foregoing, Logicworks may perform 
Emergency Maintenance, which is Maintenance that is required to maintain the security or performance of the 
Configuration, Datacenter Facilities, or Logicworks' network, at any time, as needed, upon prior written notice to 
Client, or if prior written notice is not practicable under the circumstances, as soon thereafter as it can reasonably be 
provided. All or part of the Services may be unavailable while Maintenance or Emergency Maintenance is performed. 
Logicworks will use best efforts, with equitable consideration to its other clients, to ensure that Maintenance and 
Emergency Maintenance is completed in as little time as possible. Logicworks has the right to install critical patches 
fe.g.. patches that address security vulnerabilities), regardless of whether those critical patches interfere with the 
Services or any Content. Logicworks will coordinate with Client for the application of all patches as they are released 
by vendors, and Client may not unreasonably withhold its approval of any noncritical patch. Logicworks will not be 
liable for any security upgrade or any patch refused by Client, and, if Client permits Logicworks to apply a patch, 
Logicworks will not be liable for the implementation of any security upgrade or patch that is properly applied but that 
does not perform as reported. 

18. [Intentionally Omitted] 

19. UPGRADES. Subject to Client's commitment to pay the Recurring Fee for the entire Committed Term, 
Client may request an upgrade to the Configuration. The terms of any Client request for an upgrade will not become 
part of this Agreement unless the parties incorporate them into an SO, Logicworks will not be required to make any 
upgrade unless it is set forth in an SO issued by Logicworks and signed by Client. Client acknowledges that an upgrade 
purchased without a term commitment will result in a significantly higher monthly and setup fee.. 

20. AMENDMENTS. Except as provided in this Section, no amendment to this Agreement will be 
effective unless it is in writing and signed by the parties. 

(a) LOGICWORKS AMENDMENTS. On no less than sixty days' advance notice to Client, 
Logicworks may request to: (1) amend the AUP to include reasonable restrictions on the Services that are 
consistent with industry standards; (2) amend the Responsibility Matrix to allocate new responsibilities 
between the parties; (3) amend the Technical Policies to address reliability, availability or security issues 
relating to hardware or software specifications. No Technical Policy amendment will affect the Recurring Fee 
during the Committed Term. . No amendment by Logicworks pursuant to this Section 20 will apply 
retroactively before its effective date or until signed by Client's authorized representative. 

(b) CLIENT OBJECTIONS. Client may terminate this Agreement before the end of the Committed 
Term without liability for the Early Termination Fee in accordance with Section 24(b) (Termination By Client) 
below if: (1) an amendment to the AUP, Responsibility Matrix or Technical Policies has a material adverse 
effect on Client; (2) Logicworks receives a notice from Client that reasonably identifies each material adverse 
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effect thirty days after receipt of such amendment; and (3) Logicworks does not exempt Client from the 
amendment before its effective date. 

21. SECURITY; FEES FOR UNAUTHORIZED USE AND EXCESS BANDWIDTH. Client shall implement security 
measures that are commercially reasonable for its use of the Services. Client is responsible for maintaining the 
secrecy of all information required to access the Services ( e.g., passwords and user names). Client shall encrypt any 
Personally Identifiable Information transmitted to or from, or stored on, Logicworks' Servers or storage devices. Client 
shall pay Logicworks for all Services accessed through its account, including all fees resulting from unauthorized use, 
except where the unauthorized use results from Logicworks' breach of this Agreement. Logicworks will measure 
bandwidth usage at the public Ethernet ports on Client's firewalls. Bandwidth calculated using the 95th percentile 
method will be billed to the nearest Mbps. An SO may specify the amount of bandwidth included in the Recurring Fee 
or the amount of bandwidth that will be billed at a committed rate ("Bandwidth Commitment"). Client shall pay 
Logicworks for inbound and outbound bandwidth usage that exceeds the Bandwidth Commitment ("Excess 
Bandwidth") at the Excess Bandwidth rate identified in an SO. If a committed rate is not identified in an SO, Excess 
Bandwidth will be billed at Logicworks' then-current rate. Bandwidth usage will reset at the end of each calendar 
month. Logicworks shall immediately notify CGI of an unauthorized access alert that is generated by its monitoring 
tools either through LogicOps or by sending an email to Client's Service Delivery Manager or their designee. 

22. [Intentionally Deleted] 

23. SUSPENSION. Logicworks may immediately, upon written notice to Client's Service Delivery Manager 
, accompanied by a reasonable, detailed explanation, suspend the Services without liability if (A) Logicworks 
reasonably believes that Client's use of the Services violates applicable law; (B) Logicworks is required to suspend 
Client's Services by a law enforcement agency, government agency, or court order; or (C) activity on Client's Servers, 
such as a denial of service attack or unauthorized access, poses a threat to the integrity of Logicworks' network or 
Logicworks' other clients. . Services may not be available in whole or in part during a suspension. Notwithstanding 
the foregoing, Contractor shall use best efforts to the extent practical, (i) to deploy a practical workaround in lieu 
of suspension, (ii) to inform the HIX/IES Entities' Senior Operations Manager and Contracts Manager via 
telephone prior to any such suspension and (iii) to resume operation as soon as possible thereafter. 

24. TERMINATION. Termination by either party for any reason will not relieve Client of its obligation to 
pay all fees incurred prior to and including the date of termination. 

(a) [Intentionally Removed] 

(b) TERMINATION BY CLIENT. Client shall pay the Early Termination Fee defined below in Section 

(c) (Early Termination Fee) if it terminates this Agreement before the end of the Committed Term, except as 
follows: (1) if Logicworks materially breaches any provision of this Agreement and fails to cure that breach 
within thirty days (3 days for breach of the Data Management Agreement in Attachment C of Exhibit B) of 
receiving a notice from Client that reasonably identifies the breach; or (2) non-availability of funds from the 
University due to non-appropriations per the Prime Contract Flow-Downs hereto; (3) termination of the 
Prime Contract by the University of Massachusetts for cause; or (4) termination of the hosting component of 
the Prime Contract by the University of Massachusetts for cause 

(c) EARLY TERMINATION FEE. Except as stated in Section 23(b) above, CGI shall pay Logicworks 
an additional termination fee to cover the liquidated/stranded costs incurred by Logicworks ("Early 
Termination Fee") if CGI terminates the Services or the Agreement in its entirety before the end of the 
Committed Term. The Early Termination Fee shall be calculated as follows: 

(i) If the Hosting Services are terminated for convenience within the first 12 months of 
the Hosting Term, CGI shall pay LogicWorks an amount equal to twelve (12) times the then-current 
monthly Hosting Fee. 
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(ii) If the Hosting Services are terminated for convenience after the first 12 months of 
the Hosting Term, CGI shall pay LogicWorks an amount equal to the then-current monthly Hosting 
Fee multiplied by the number of months remaining in the Hosting Term at the time of such 
termination. 

25. RETURN OF CONTENT AND COLOCATED DEVICES; EFFECT OF TERMINATION; SURVIVAL. 

(a) RETURN SHIPMENTS. Subject to Logicworks' receipt of written shipment instructions from 
Client, Logicworks shall ship Content and colocated devices to Client. All Content must be encrypted by Client 
while in motion and at rest and Client shall not provide the encryption key to Logicworks. Client shall not 
instruct Logicworks to ship any Content that is not encrypted. Client is solely responsible for ensuring that all 
Content is encrypted prior to shipment; Logicworks will not examine Content prior to shipment to ensure that 
it has been encrypted. Shipment of all Content and colocated devices is at the sole expense and risk of Client 
unless Logicworks fails to follow Client's reasonable written shipment instructions. Provided Logicworks 
follows Client's written instructions regarding the shipment of the Content or colocated devices, Logicworks 
shall have no liability to Client for any data breach or other Security Incident arising from or relating to the 
such shipment of any Content or colocated device, except if caused by Logicworks' gross negligence or 
Intentional Misconduct. 

(b) TERMINATION. Effective immediately upon the termination of this Agreement, the Services 
will no longer be available. Upon termination, Logicworks will return all data or Content and Colocated 
Devices to Client and, decommission the Hosting Equipment and upon Client confirmation, permanently 
erase all Content stored on such Hosting Equipment. Logicworks shall not retain any copies of Content in any 
form except as required by the Data Management Agreement. The obligations in the Data Management 
Agreement shall survive the termination or expiration of the Agreement and continue until such time as the 
Content is returned to Client or destroyed. If any Content is to be retained by Logicworks after termination, 
Logicworks may either remove the hard disks specified by Client from the Configuration or copy the Content 
on those disks to portable storage media. Client shall ensure that all Content remains encrypted at all times. 
Notwithstanding the foregoing, in no event will Logicworks be required to keep the Services or any Content 
accessible over the Internet after termination. Client agrees to pay Logicworks' reasonable fees for Services 
and Additional Services provided under this Section 25(b) and for all reasonable costs, including the cost of 
storage media and hard disks that are being sent to Client. All terms of this Agreement that should by their 
nature survive termination will survive, including, Sections 1 (The Agreement; Effective Date), 6 (Fees and 
Payment), 7 (Taxes), 21 (Security; Excess Usage; Unauthorized Fees), 24 (Termination), 26 (Warranties; 
Disclaimers), 27 (Limitation of Damages), 28 (Indemnification), 30 (Governing Law; Venue; Jurisdiction), 35 
(Representations; No Changes), 36 (Neutral Interpretation), 37 (Force Majeure), 38 (Confidentiality), 39 (Non- 
Solicitation), 43 (Definitions), 44 (Miscellaneous) and 45 (Scope of Agreement; Entire Agreement). 

26. WARRANTIES; DISCLAIMERS. EXCEPT AS EXPRESSLY REQUIRED BY LAW WITHOUT THE POSSIBILITY OF 

CONTRACTUAL WAIVER, THE PARTIES AGREE TO THE FOLLOWING: 

(a) LOGICWORKS WILL PROVIDE THE SERVICES AND ADDITIONAL SERVICES, IF ANY, IN A 
WORKMANLIKE AND PROFESSIONAL MANNER. EXCEPT AS PROVIDED IN THE PREVIOUS SENTENCE, ALL 
GOODS AND SERVICES ARE PROVIDED "AS-IS". LOGICWORKS AND ITS SERVICE SUPPLIERS DISCLAIM ALL 
WARRANTIES, EXPRESS AND IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A 
PARTICULAR PURPOSE, NON-INFRINGEMENT, TITLE, AND ANY WARRANTIES ARISING FROM A COURSE OF 
DEALING, USAGE OR TRADE PRACTICE. CLIENT IS SOLELY RESPONSIBLE FOR THE SUITABILITY OF ALL GOODS 
AND SERVICES CHOSEN AND FOR DETERMINING WHETHER THEY MEET ITS CAPACITY, PERFORMANCE AND 
SCALABILITY NEEDS. 

(b) NEITHER LOGICWORKS NOR ITS SERVICE SUPPLIERS WARRANT THAT THE SERVICES AND 
ADDITIONAL SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, COMPLETELY SECURE, OR THAT ALL DEFECTS 
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WILL BE CORRECTED. CLIENT ACKNOWLEDGES THAT LOGICWORKS DOES NOT CONTROL OR MONITOR THE 
TRANSFER OF DATA OVER TELECOMMUNICATIONS FACILITIES, INCLUDING THE INTERNET, AND THAT 
INTERNET ACCESSIBILITY CARRIES WITH IT THE RISK THAT CLIENT'S PRIVACY, CONFIDENTIAL INFORMATION 
AND PROPERTY MAY BE LOST OR COMPROMISED. 

(c) CLIENT ACKNOWLEDGES THAT LOGICWORKS OFFERS NUMEROUS SECURITY OPTIONS AS 
PART OF THE SERVICES AND ADDITIONAL SERVICES. CLIENT IS RESPONSIBLE FOR SELECTING ON A SERVICE 
ORDER THE SECURITY OPTIONS THAT IT DETERMINES MEET CLIENT'S NEEDS. CLIENT AGREES THAT 
LOGICWORKS SHALL HAVE NO LIABILITY FOR ANY PROVISION OF SECURITY-RELATED SERVICES OR ADVICE 
THAT LOGICWORKS MAY VOLUNTARILY PROVIDE OUTSIDE THE SCOPE OF THE SERVICE ORDER(S). 

(d) CLIENT'S USE OF ANY SERVICE PROVIDED BY LOGICWORKS THAT IS INTENDED TO COMPLY 
WITH CERTAIN LAWS, STANDARDS OR REGULATIONS WILL NOT GUARANTEE THAT CLIENT IS IN COMPLIANCE 
WITH THOSE LAWS, STANDARDS OR REGULATIONS. CLIENT IS ULTIMATELY RESPONSIBLE FOR 
UNDERSTANDING AND ENSURING THAT ITS BUSINESS OPERATIONS AND ITS USE OF LOGICWORKS' SERVICES 
COMPLY WITH ALL APPLICABLE LAWS, REGULATORY STANDARDS AND REQUIREMENTS. 

27. LIMITATION OF LIABILITY. EXCEPT AS EXPRESSLY REQUIRED BY LAW WITHOUT THE POSSIBILITY OF 

CONTRACTUAL WAIVER, THE PARTIES AGREE TO THE FOLLOWING LIMITATIONS ON LIABILITY: 

(e) IF EITHER PARTY SHOULD BECOME ENTITLED TO CLAIM DAMAGES FROM THE OTHER FOR 
ANY REASON (INCLUDING WITHOUT LIMITATION, FOR BREACH OF CONTRACT, BREACH OF WARRANTY, 
NEGLIGENCE OR OTHER TORT CLAIM), THE PARTY SUBJECT TO THE CLAIM WILL BE LIABLE ONLY FOR THE 
AMOUNT OF THE DAMAGED PARTY'S ACTUAL DAMAGES AND IN NO EVENT WILL SUCH AMOUNT EXCEED IN 
THE AGGREGATE AN AMOUNT IN EXCESS OF TWELVE TIMES THE RECURRING FEE FOR THE MONTH 
IMMEDIATELY PRECEDING THE MONTH IN WHICH THE FIRST EVENT GIVING RISE TO THE CLAIM(S) OCCURRED. 
THIS SECTION 27 SHALL NOT APPLY TO CLAIMS ARISING FROM (I) A BREACH OF CONFIDENTIALITY OR 
SECURITY REQUIREMENTS SET FORTH IN THE CONTRACT, (II) FAILURE TO COMPLY WITH LAWS APPLICABLE TO 
CONTRACTOR; (III) GROSS NEGLIGENCE OR WILLFUL MISCONDUCT OF A PARTY; OR (IV) THE 
INDEMNIFICATION OBLIGATIONS UNDER SECTION 28 OF THIS CONTRACT. "GROSS NEGLIGENCE" SHALL MEAN 
THE INTENTIONAL FAILURE TO PERFORM A MANIFEST DUTY IN RECKLESS DISREGARD OF THE CONSEQUENCES 
AS AFFECTING THE LIFE OR PROPERTY OF ANOTHER. FEES DUE TO LOGICWORKS, INCLUDING ANY EARLY 
TERMINATION FEE, ARE NOT INCLUDED IN THE LIMITATION OF LIABILITY TO LOGICWORKS. FOR THE 
AVOIDANCE OF DOUBT, LOGICWORKS SHALL HAVE NO LIABILITY FOR LOSS OF FEDERAL FINANCIAL 
PARTICIPATION IN CONNECTION WITH THE HIX/IES PROJECT. 

(f) NOTWITHSTANDING ANYTHING IN THE AGREEMENT TO THE CONTRARY, IN NO EVENT WILL 
EITHER PARTY OR ITS SERVICE SUPPLIERS, OR THEIR RESPECTIVE EMPLOYEES, AGENTS OR REPRESENTATIVES 
BE LIABLE FOR ANY PUNITIVE, INDIRECT, CONSEQUENTIAL OR SPECIAL DAMAGES, OR FOR ANY LOST PROFITS, 
LOST DATA, LOST BUSINESS, LOST REVENUES, DAMAGE TO GOODWILL, LOST OPPORTUNITIES OR LOSS OF 
ANTICIPATED SAVINGS, EVEN IF ADVISED OF THE POSSIBILITY OF SAME, AND REGARDLESS OF WHETHER THE 
CLAIMS ARE BASED IN CONTRACT, TORT, STRICT LIABILITY, INFRINGEMENT, OR ANY OTHER LEGAL OR 
EQUITABLE THEORY. 

(g) NOTWITHSTANDING ANYTHING IN THE AGREEMENT TO THE CONTRARY, IN NO EVENT WILL 
LOGICWORKS OR ITS SERVICE SUPPLIERS, OR THEIR RESPECTIVE EMPLOYEES, AGENTS OR REPRESENTATIVES 
BE LIABLE FOR UNAUTHORIZED ACCESS (E.G.. HACKING OR MALWARE) INTO LOGICWORKS' OR CLIENT'S 
TRANSMISSION FACILITIES, PREMISES OR EQUIPMENT, OR FOR UNAUTHORIZED ACCESS TO CLIENT'S DATA 
FILES, PROGRAMS, PROCEDURES OR INFORMATION, UNLESS THE UNAUTHORIZED ACCESS IS CAUSED BY 
LOGICWORKS OR ITS NETWORK SERVICE SUPPLIERS', OR THEIR RESPECTIVE EMPLOYEES, AGENTS OR 
REPRESENTATIVES' GROSS NEGLIGENCE OR INTENTIONAL MISCONDUCT (AS DEFINED IN SECTION 43(m) 
BELOW) OR FAILURE TO PROVIDE THE SERVICES PER THE CONTRACT. 
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(h) THE LIMITATIONS SET FORTH IN THIS SECTION 27 SHALL APPLY TO THE FULLEST EXTENT OF 
THE LAW, NOTWITHSTANDING THE FAILURE OF THE ESSENTIAL PURPOSE OF ANY REMEDY. 

(i) [INTENTIONALLY REMOVED], 

28. INDEMNIFICATION. 

(a) Client shall indemnify, defend and hold Logicworks and its employees, agents, shareholders, 
officers, directors, successors and assigns harmless from and against any and all claims, damages, liabilities, 
costs, settlements, penalties and expenses (including attorneys' fees, expert's fees and settlement costs) 
arising out of or relating to any suit, action, proceeding, arbitration, subpoena, claim or demand brought or 
asserted by a third party pursuant to any theory of liability against Logicworks arising out of or relating to any 
one or more of the following: (1) damages caused by equipment owned by Client and located at Logicworks 
Datacenter Facilities; (2) damages to Logicworks Datacenter Facilities caused by Client or its representatives; 
or (3) the alleged or actual infringement or misappropriation of any intellectual property right or other 
proprietary right by Client, or Client's agents or, representatives; (4) a claim for wrongful death, bodily injury, 
or damage to real or tangible personal property, any pecuniary damages arising there from, and all of the 
foregoing resulting from, and to the extent caused by, any intentional or negligent acts or omissions of Client, 
its employees, servants, agents, or subcontractors; or (5) CGI's failure to encrypt Contract Data per 
Attachment C - Data Management Agreement in Exhibit B Prime Contract Flow Down Terms. 

(b) Logicworks shall indemnify, defend and hold Client and its employees, agents, shareholders, 
officers, directors, successors and assigns harmless from and against any and all claims, damages, liabilities, 
costs, settlements, penalties and expenses (including without limitation attorneys' fees, expert's fees and 
settlement costs) arising out of or relating to any suit, action, proceeding, arbitration, subpoena, claim or 
demand brought or asserted by a third party pursuant to any theory of liability against Client arising out of or 
relating to (1) the actual or alleged infringement or misappropriation of any intellectual property right by 
Logicworks or its suppliers or subcontractors or representatives; (2) damages caused by Logicworks or its 
suppliers or subcontractors or representatives to equipment owned or provided by Client or the HIX/IES 
Entities and located at Logicworks Datacenter Facilities (3) a claim for wrongful death, bodily injury, or 
damage to real or tangible personal property, any pecuniary damages arising there from, and all of the 
foregoing resulting from, and to the extent caused by, any intentional or negligent acts or omissions of 
Logicworks, its employees, servants, agents, or subcontractors in the performance, or failure to perform services 
hereunder; 

(c) Client's obligations under Section 28(a)(4) and Logicworks' obligations under Section 28(b)(1) 
will not apply to the extent that the infringement, misappropriation or violation results from: (1) 
modifications made by the indemnified party (except those directed by the indemnifying party or its 
subcontractors, agents or employees) or by any third party other than a the indemnifying party, (2) the 
combination, operation or use of the infringing item with other items the indemnifying party did not 
recommend, supply or agree to in writing; (3) the failure of indemnified party to use any new or corrected 
versions of the item made available by the indemnifying party to the indemnified party and implemented by 
the indemnifying party at no cost to the indemnified party; or (d) the indemnifying party's adherence to 
specifications or instructions provided by the indemnified party; provided that such infringement, 
misappropriation or violation would not have occurred absent (1), (2), (3) and/or (4). 

(d) For any infringement of an intellectual property right, the indemnifying party will: (a) 
procure for the indemnified party the right to continue using the item in accordance with its rights under this 
Contract; (b) replace the item with an item that does not infringe, misappropriate or otherwise violate any 
third party intellectual property rights and, in the indemnified party's reasonable discretion, complies with 
the item's specifications, and all rights of use set forth in this Contract; or (c) modify the item so that it no 
longer infringes, misappropriates or otherwise violates any third party intellectual property right and, in the 
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indemnified party's reasonable discretion, complies with the item's specifications and all rights of use set 
forth in this Contract. In the event of an infringement by the Services, and if neither of those alternatives is 
available to Logicworks on commercially reasonable terms, CGI will stop using the allegedly infringing item(s) 
and CGI will receive a refund of the amounts paid by it for the infringing item(s) and, to the extent such 
infringement was a result of Logicworks' knowingly infringing, or Logicworks should have known it was 
infringing, a third party copyright, trade secret or trademark (enforceable in the United States, any additional 
amounts paid by CGI to a third party to replace and implement/integrate the replacement Service item; 
provided, however, that CGI has mitigated such costs to replace and implement/integrate the replacement 
Service item to the greatest extent possible and any such amounts to be paid by Logicworks will be subject to 
the Limitations of Liability set forth in this MSA. This Section 28(d) states the indemnifying party's entire 
obligation and the indemnified party's exclusive remedy with respect to any claim of infringement as set forth 
herein. All other express obligations of indemnification set forth in this Section 28 shall not be construed to 
negate or abridge any other obligation of indemnification that would otherwise exist in law or in equity. 
Logicworks will not enter into any settlement involving third party claims that contains any admission of or 
stipulation to any guilt, fault, liability or wrongdoing by CGI or the HIX/IES Entities without CGI's prior written 
consent. CGI will engage in good faith discussions with Logicworks regarding any such settlement, however, 
such consent may be withheld in CGI's sole and absolute discretion. The extent of the Contract 
indemnification shall not be limited by any obligation or any term or condition of any insurance policy. The 
obligations set forth above shall survive the expiration or termination of the Contract 

(e) Each party's indemnification obligations hereunder will be subject to: (1) the prompt receipt 
by the indemnifying party of a written notice of the existence of any basis for indemnification, except if the 
delay does not prejudice the indemnifying party; (2) the indemnifying party's right to participate in the 
defense of any action at its own costs; (4) the indemnifying party's approval of any settlement, which 
approval will not be unreasonably withheld; and (5) the indemnifying party's receipt of reasonable 
cooperation from the indemnified party. 

29. HIGH RISK USE. Client shall not use the Services for any application where a failure of those Services 
could result in death, serious injury, environmental damage or property damage. Examples of prohibited uses include 
medical life support devices, water treatment facilities, nuclear facilities, weapons systems, chemical facilities, mass 
transportation, aviation and flammable environments. Client acknowledges that Logicworks makes no assurances that 
the Services are suitable for any high-risk use. 

30. GOVERNING LAW; VENUE; JURISDICTION; WAIVER OF JURY TRIAL. The laws of the Commonwealth of 
Massachusetts, without reference to its choice of law principles, govern this Agreement and any claims arising out of 
or relating to this Agreement, its negotiation, execution, performance, or breach. All disputes and controversies 
arising out of or relating to this Agreement, its negotiation, execution, performance, or breach not resolved by the 
informal dispute resolution process in Exhibit B must be resolved in the state and federal courts in the Commonwealth 
of Massachusetts, and each party irrevocably consents to the exclusive venue and personal jurisdiction of those courts 
for the resolution of such disputes and waives all objections thereto. Except as prohibited by law, each party 
irrevocably waives its right to a jury in connection with any action arising out of or relating to this Agreement. 

31. INTELLECTUAL PROPERTY. Except as provided in Section 32 (Publicity) below, this Agreement does 
not convey to either party any ownership right or license to use, sell, exploit, copy or further develop the other party's 
Confidential Information (as defined in Section 38) or intellectual property, including patents, copyrights, trademarks, 
trade names and trade secrets. Logicworks has the exclusive right and title to any intellectual property developed by 
Logicworks during and in connection with providing the Services to Client. 

32. PUBLICITY. Neither party may use the other party's name and trademarks, other than on internal 
client listings, except as otherwise approved in writing, which consent shall not be unreasonably withheld. Logicworks 
may not use the University's or Commonwealth's name or logo except as expressly approved in writing. 
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33. RELATIONSHIP OF THE PARTIES. Logicworks and Client are independent parties. This Agreement and 
any transaction under it does not create an agency, joint venture, or partnership between Client and Logicworks. 

There is no landlord-tenant relationship between the parties. Client has no right to access Logicworks' premises or 
Datacenter Facilities and no right to possess or own Logicworks' software, Server hardware or other equipment. No 
act or direction of Client shall be deemed to create an employer/employee or joint employer relationship. Logicworks 
shall not be obligated under any contract, subcontract, or other commitment made by Client, including the Prime 
Contract. 

34. NOTICES, For any notice under this Agreement to be valid, it must be sent by one of the following 
methods of delivery: (i) personal delivery; (ii) registered or certified mail, in each case return receipt requested and 
postage prepaid; (iii) nationally recognized overnight courier, with all fees prepaid; or (iv) email. 

(a) For a notice under this Agreement to be valid, it must be addressed as follows: (1) if to 
Logicworks, Attn: Legal, Logicworks Systems Corporation, 155 Avenue of the Americas, Fifth Floor, New York, 
NY 10013 or to billing@logicworks.net, as applicable; (2) if to Client, to one or more of the mailing or email 
addresses listed above, as applicable with a copy of legal notices to CGI Technologies and Solutions Inc. 11325 
Random Hills Road, 8 th Floor, Fairfax, VA 22030, Attn: Office of General Counsel; or (3) to any other address 
designated by the receiving party in a notice in accordance with this Section 34. 

(b) Subject to this Section 34, a notice under this Agreement is effective when received. An 
email notice is deemed received when the recipient acknowledges its receipt in a reply email or other written 
communication. All other notices sent by either party will be deemed received when delivered in person or 
signed for by the recipient as indicated by the signed delivery receipt. If the receiving party refuses to accept 
delivery, or if delivery is impossible because of a change in address for which no notice was given, notice will 
be deemed received upon the rejection or inability to deliver. If a notice is received at the location specified in 
the receiving party's address in this Section 34 after 5:00 p.m., or on a day other than a Business Day, notice 
will be deemed received on the following Business Day. 

35. REPRESENTATIONS; NO CHANGES. Each party represents that it has the requisite power and 
authority to execute and deliver this Agreement and to perform its obligations hereunder, that the execution and 
delivery of this Agreement will not conflict with or violate any provision of its charter, by-laws or other governing 
documents, and that each party has taken all necessary steps to execute this Agreement. Client warrants that it has 
not knowingly provided inaccurate or incomplete information to Logicworks. Client warrants that its use of the 
Services will comply with all local, state, and federal laws, regulations and ordinances applicable to Client in the 
performance of its obligations under this Agreement. 

36. NEUTRAL INTERPRETATION. This Agreement will be construed and interpreted in a neutral manner. 
This Agreement is a negotiated document and will be deemed drafted jointly by the parties. No rule of construction 
or interpretation will apply against any particular party based on a contention that the Agreement was drafted by one 
of the parties. 

37. FORCE MAJEURE, If a party's performance of any part of this Agreement, is prevented or delayed by 
reason of an act of God, act of war, act of terrorism, fire, governmental action, labor dispute or other cause beyond 
the performing party's control, then that party will be excused from performance for the length of that prevention or 
delay. 


38. CONFIDENTIALITY. 

(a) CONFIDENTIAL INFORMATION. "Confidential Information" means: (1) with respect to 
Logicworks, server configurations, software configurations, proprietary information, proprietary technology, 
proprietary software, unpublished prices and terms for the Services, audit reports, information regarding 
product development, information regarding Logicworks' Datacenter Facilities, and information contained in 
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manuals, proposals or memoranda; (2) with respect to Client, non-public Content transmitted to or from, or 
stored on, Logicworks' servers; and (3) with respect to both parties, the terms of this Agreement, information 
that is conspicuously marked as "confidential" or "proprietary," information disclosed verbally that is 
designated as "confidential" or "proprietary" at the time of disclosure, and information that, by its nature, 
would reasonably be considered as confidential to any other person, firm or corporation. 

(b) EXCLUSIONS. Confidential Information does not include: (1) information that is 
independently developed by a recipient without the use of the disclosing party's Confidential Information as 
shown by the recipient's written business records; (2) information that is known by a recipient prior to 
disclosure by the disclosing party as shown by the recipient's written business records; or (3) information that 
is or becomes generally available to the recipient or the public other than through a violation of this 
Agreement. 

(c) RESTRICTIONS ON USE AND DISCLOSURE. A party shall not disclose the other party's 
Confidential Information except: (1) on a need-to-know basis, to its agents and representatives who are 
bound by confidentiality restrictions at least as stringent as those stated in this Agreement; (2) as required by 
law, governmental regulation or requirement, court order, or subpoena, in which case and subject to 
applicable law, the non-disclosing party shall use best efforts to provide prompt notice to the disclosing party 
so that the disclosing party may seek a protective order or other appropriate remedy; or (3) the terms of this 
Agreement as may be necessary to establish or assert its rights hereunder. A party shall not use Confidential 
Information except as required to perform its obligations under this Agreement. Notwithstanding the 
forgoing, Client may provide a copy of this Agreement to its ultimate customer, with financials redacted, for 
the purpose of such customer confirming compliance with the Prime Contract. 

(d) TREATMENT OF CONFIDENTIAL INFORMATION. Each party shall use the same degree of care 
to protect Confidential Information that it uses to protect its own highly confidential information from 
unauthorized disclosure, but in no event shall either party use less than a commercially reasonable degree of 
care. The recipient shall notify the disclosing party promptly upon its discovery of any unauthorized use or 
disclosure of Confidential Information, and will use commercially reasonable efforts to cooperate with the 
disclosing party to regain possession of all Confidential Information and to prevent any further unauthorized 
use or disclosure. 

(e) RETURN OF CONFIDENTIAL INFORMATION. On the disclosing party's written request or upon 
expiration or termination of this Agreement for any reason, the receiving party will promptly: (1) return or 
destroy, at the disclosing party's option, all originals and copies of all documents and materials it has received 
containing the disclosing party's Confidential Information; and (2) deliver or destroy, at the disclosing party's 
option, all originals and copies of all summaries, records, descriptions, modifications, drawings, adoptions and 
other documents or materials, whether in writing or in machine-readable form, prepared by the receiving 
party, prepared under its direction, or at its request from the documents and materials referred to in the 
preceding clause (1) of this Section (e). On the disclosing party's written request, the recipient shall provide a 
notarized written statement to the disclosing party certifying that all documents and materials referred to in 
subparagraphs (1) and (2) of this Section (e) have been delivered to the disclosing party or destroyed as 
requested. 

(f) NON-EXCLUSIVE EQUITABLE RELIEF. Each party acknowledges and agrees that due to the 
unique nature of Confidential Information there may be no adequate remedy at law for any breach of its 
obligations hereunder, that any such breach or threatened breach may allow a party or third parties to 
unfairly compete with the other party resulting in irreparable harm to such party, and therefore, that upon 
any such breach or any threat thereof, each party is entitled to seek appropriate equitable and injunctive 
relief from a court of competent jurisdiction without the necessity of proving actual loss, in addition to 
whatever remedies either of them might have at law or equity. 
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39. [Intentionally Omitted], 


40. ASSIGNMENT; RESALE; BINDING EFFECT. Neither party may assign this Agreement or resell the right 
to use the Services without the other party's prior written consent, which consent will not be unreasonably withheld.. 
Any purported assignment in violation of the preceding sentence will be void. This Agreement will be binding upon 
and inure to the benefit of all successors and assigns of Logicworks and Client, who will be bound by all of the 
obligations of their predecessors or assignors. 

41. SUBCONTRACT. Logicworks may, upon Client written approval which shall not be unreasonably 
delayed or withheld, subcontract any portion of the Services to a third-party contractor, provided that Logicworks 
remains fully responsible to Client for the Services pursuant to this Agreement. The Client is entitled to copies of all 
hosting-related significant subcontracts (with financials redacted) that materially impact Logicworks' obligations under 
the Agreement, for purposes of verifying Logicworks' compliance with the Agreement. Any subcontractor will be 
deemed to be an independent contractor and not a partner, agent or employee of Logicworks or of Client. 

42. EXPORT CONTROL. Both parties shall comply with all applicable import, export and re-export control 
laws and regulations, including the U.S. Export Administration Regulations, the International Traffic in Arms 
Regulations, and the sanctions maintained by the Treasury Department's Office of Foreign Assets Control. Client 
represents and warrants that the Services will not be accessed, downloaded, used, exported or re-exported, directly 
or indirectly, to any location, entity, government or person prohibited by the applicable laws or regulations of any 
jurisdiction, including the U.S., without prior authorization from all relevant government authorities. 

43. DEFINITIONS. 

(a) "Application" means software that performs a specific task, as opposed to an operating 
system, which runs a computer or server. 

(b) "Acceptable Use Policy" and "AUP" mean the acceptable use policy in Exhibit E attached 

hereto. 

(c) "Business Day" means Monday through Friday, except U.S. bank holidays. 

(d) "Configuration" means, collectively, the Flosting Equipment, Internet access, bandwidth and 
software provided by Logicworks to Client as specified in the SO(s). 

(e) "Datacenter Facilities" means one or any combination of the third-party facilities used by 
Logicworks to host Servers, which facilities have backup power, specialized HVAC systems to provide adequate 
cooling, 24/7 security and specialized fire suppression equipment, 

(f) "Datacenter Failure" means a total disruption in the power supply to the Hosting Equipment 
and/or a failure of the Datacenter Facility's HVAC system. 

(g) "Downtime" means one or any combination of the following: (1) Infrastructure Downtime 
and (2) Application Downtime, as those terms are defined in Section 18 (Service Level Agreement). 

(h) "Federal Required Change" means any change in applicable laws, rules or regulations or 
change required by the Federal Government, including, without limitation, CCIIO or CMS, a legislative action, 
a legislative request, executive order, or judicial decision that requires a change in the HIX/IES System Hosting 
Services. 


(i) "Hardware Upgrade Fee" means a one-time fee that applies to the installation of hardware 
to Client's Configuration, including hardware and labor charges required for implementation. 
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(j) "High Availability Hardware" is Hosting Equipment that is configured with at least one 
equivalent and redundant counterpart such that if one counterpart fails, a procedure can be implemented to 
failover to its identical, functioning counterpart. High Availability Hardware can be configured in an 
active/active configuration or an active/passive configuration. Failover can be automatic or manual, 
depending on the configuration chosen by Client, 

(k) "HIX/IES Entity" means individually and collectively the University of Massachusetts Medical 
Center ("University"), the Massachusetts Executive Office of Health and Human Services ("EOHHS") and the 
Massachusetts Commonwealth Health Connector Authority ("CCA") 

(l) "Hosting Equipment" means the Server Hardware, cables, routers, switches, and other 
hardware that Logicworks makes available to Client as specified in an SO. 

(m) "Infrastructure" means the Datacenter Facilities and Hosting Equipment made available to 
Client as part of the Services. 

(n) "Intentional Misconduct" means an intentional act or omission intended to cause harm. 

(o) "Massachusetts Required Change" means any change in applicable laws, rules or regulations 
or change required by the Commonwealth of Massachusetts, a legislative action, a legislative request, 
executive order, or judicial decision that requires a change in the HIX/IES System Hosting Services 

(p) [Intentionally Omitted] 

(q) "Responsibility Matrix" means the responsibility matrix attached hereto as Exhibit D. 

(r) "Server" means a physical or Virtual Server that is identified on a Service Order and 
deployed and administered by Logicworks. 

(s) "Server Hardware" means all internal Server components, including processors, chassis, 
network cards, memory, hard drives, storage and power supplies. 

(t) "Shared Device" means any Hosting Equipment that is used by Client and at least one other 
client of Logicworks, such as a shared load balancer, switch or Server. 

(u) "Technical Policies" means the written technical policies and requirements attached hereto 
as Exhibit F, as they may be amended from time to time in accordance with Section 20 (Logicworks 
Amendments). 

(v) "Virtual Server" means one of any number of isolated server instances running on a single 
physical server. 

44. MISCELLANEOUS. The headings in this Agreement are solely for convenience of reference and will 
not affect its interpretation. This Agreement does not create any third-party beneficiary rights. A fully signed copy of 
this Agreement made by reliable means (Le^, facsimile, or electronic image) will be considered an original. If any 
provision in this Agreement is determined to be invalid, illegal or unenforceable, the validity, legality and 
enforceability of the remaining provisions in the Agreement shall not in any way be affected or impaired thereby and 
such provision shall be ineffective only to the extent of its invalidity, illegality or unenforceability. No waiver of any 
provision of this Agreement will be effective unless in writing signed by the waiving party, and no delay or failure to 
exercise or enforce any right or remedy hereunder will constitute a waiver of that right or remedy. Express waiver of 
any right or remedy in a particular instance will not constitute a waiver of that right or remedy in any other instance, 
or a waiver of any other right or remedy. The word "including" is a term of expansion, not limitation. Unless 
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otherwise indicated, all references to a day are references to a calendar day and all references to a time of day are 
references to the time in New York, N.Y. If any date specified in this Agreement as the only day, or the last day, for 
taking action falls on a day that is not a Business Day, that action may be taken on the next Business Day. 

45. SCOPE OF AGREEMENT; ENTIRE AGREEMENT. This Agreement constitutes the entire agreement 
between the parties regarding its subject matter, and it supersedes all other oral or written agreements or policies 
relating thereto. If there is a conflict between or among any of the documents in this Agreement, they will govern in 
the following order: the Prime Contract Flow Down Terms, a Service Addendum, the MSA, the AUP, the Responsibility 
Matrix, the Technical Policies, and the most recent Service Order. Additional or different terms in any written 
communication from Client, including any purchase order or request for Services, are void. 

The individuals signing below represents that they are authorized to sign behalf of their respective party, 
and that such party has reviewed and accepts the terms of this Agreement, including the MSA, the attached Service 
Addenda(um), the Service Order(s), the AUP, the Technical Policies, and the Responsibility Matrix. The parties are 
signing this Agreement on the date indicated below their signatures. 

CGI Technologies and Solutions Inc. LOGICWORKS SYSTEMS CORPORATION 


By: 


By: 


Name 


Title 


Date 


Name 


Title 


Date 
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Exhibit B - Prime Contract Flow Down Terms 


The following provisions are excerpted from the contract between CGI Technologies and Solutions Inc. (as referred 
to in this Exhibit B, “CGi” or the “University”) and the University of Massachusetts, Worcester Campus on behalf of 
the Commonwealth of Massachusetts, Massachusetts Health Insurance Exchange and Integrated Eligibility System 
(collectively, “MA HIX/IES”) Systems Integrator Project (the “Prime Contract”). References below to “Contractor” 
shall be read so as to mean Logicworks Systems Corporation, References below to the “Contract” shall be read so 
as to mean the “Agreement”, as that term is defined in the MSA. All capitalized terms not defined herein shall have 
the meaning ascribed to them elsewhere in the Agreement. In addition to the other terms of the Contract, Contractor 
agrees to the following terms and conditions, which are derived from the Prime Contract to the extent they are 
applicable to Logicworks' scope of work as described in the Contract and its attachments; such scope being for the 
provision of infrastructure management and physical security of the hosted environments but not including application 
management or application security, In addition, the parties acknowledge that Logicworks will not be granted access 
to unencrypted Contract Data and that CGI is responsible for encryption as per Attachment C hereto. All 
assignments, indemnifications, insurance, warranties, etc. herein shall be to CGI’s benefit as prime contractor. 


_ BASE Contract _ 

1. Reserved, 

2. Reserved. 

3. Reserved. 

4. Reserved. 

5. Reserved. 

6. Compliance with Laws: Contractor agrees to comply with all local, state, and federal laws, regulations and 
ordinances applicable to Contractor in the performance of its obligations under this Contract. Without limiting the 
foregoing, it is understood that Contractor's subcontractors shall comply with all applicable local, state, and 
federal laws, regulations and ordinances applicable to the performance of the respective portion of the services 
each subcontractor is providing under this Contract. 

7. Independent Contractor Status: The Contractor is an independent contractor and not an employee or agent of 
the University. No act or direction of the University shall be deemed to create an employer/employee or joint 
employer relationship. The University shall not be obligated under any contract, subcontract, or other 
commitment made by the Contractor. 

8. Contractor's Qualifications and Performance: In accordance with the terms and conditions of this Contract, 
the Contractor represents that it is qualified to perform the services set forth herein and has obtained all requisite 
licenses and permits to perform the services. In addition, the Contractor agrees that the services provided 
hereunder shall conform to the professional standards of care and practice customarily expected of firms 
engaged in performing comparable work; that the personnel furnishing said services shall be qualified and 
competent to perform adequately the services assigned to them; and that the recommendations, guidance, and 
performance of such personnel shall reflect such standards of professional knowledge and judgment. 

9. Termination: 

A. Termination without Cause: The Contract may be terminated without cause, in whole or in part, by 
the University by giving written notice to the Contractor at least thirty (30) calendar days prior to the 
effective date of termination stated in the notice. The University may terminate any Work Order or 
portion thereof by giving written notice to the Contractor at least fifteen (15) calendar days before the 
effective date of termination stated in the notice, Unless expressly stated otherwise, in the event of the 
termination of any Work Order or portion thereof, the remainder of the Contract shall remain in full force 
and effect. 

B. Termination for Cause: If Contractor breaches any material term or condition stated herein or fails to 
perform or fulfill any material obligation required by this Contract, the University may terminate this 
Contract, in whole or in part, by giving written notice to the Contractor at least thirty (30) calendar days 
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before the effective date of termination stated in the notice. Notwithstanding the preceding sentence, to 
the extent Contractor has executed a Data Management Agreement in addition to this Contract and 
fails to fulfill his/her obligations under the Data Management Agreement, the University may terminate 
this Contract by giving written notice to the Contractor at least three (3) calendar days before the 
effective date of termination stated in the notice. Any notice of termination provided pursuant to this 
section shall state the circumstances of the alleged breach and shall, if the breach is curable, state a 
period during which the alleged breach may be cured, but in no event less than fifteen (15) calendar 
days before the effective date of termination stated in such notice (or three (3) calendar days before the 
effective date of termination in the case of a Data Management Agreement breach). In the event of a 
breach by Contractor, Contractor may be subject to any and all applicable contract rights and remedies 
available to the University or otherwise available under law or equity, subject to Section 36. Limitation 
of Liability, Attachment A, Amendment No.1, Updated HIX/IES Special Terms and Conditions. 
Applicable statutory or regulatory penalties may also be imposed by applicable state or government 
entities. 

C, Suspension for Unpaid Undisputed Invoices. In the event (i) University has not paid undisputed 
invoices for previously approved Milestones or in the case of Work Order 9 (Hosting) and Work Order 
12 (Interstate (NESCIES) Support), previously approved monthly invoices, and (ii) such non-payment 
issue has not been resolved within thirty (30) days, or other period of time mutually agreed to in writing, 
of the meeting of the University Chancellor and CGI President in accordance with the escalation 
process set forth in Section 26(D) below; CGI, may, upon seven (7) calendar days’ written notice to 
University, suspend further services on the HIX/IES project. The foregoing is contingent upon (a) the 
HIX/IES Entities' right to use of all deliverables and work in progress up to the effective date of the 
suspension without disturbance or interruption and (b) each party’s continued negotiation with the other 
in good faith to resolve such non-payment issue. Upon resolution of the non-payment issue, the parties 
will mutually agree to a change order to address payment of reasonable Contractor costs related to the 
suspension as well as for the resumption of services, This change order will address, without limitation, 
suspension costs, and any changes to schedule, scope, key personnel, and price. Services will resume 
upon signature of the mutually agreed change order. 

10. Obligations in Event of Termination: 

A. Upon termination or expiration of this Contract, or any portion thereof, all work performed or provided by 
the Contractor for delivery to the University pursuant to the Contract, or portion thereof, including 
without limitation, any and all Work Product and Contractor Property contained or licensed therein (as 
those terms are defined in Additional Terms, Section 11 of Attachment A, Amendment #1, Updated 
HIX/IES Special Terms and Conditions), shall be delivered to the University. To the extent the 
Contractor has executed a Data Management Agreement in addition to this Contract, Contractor shall, 
at the University's direction and within the time frames specified by the University, either return or 
destroy all Contract Data (as defined in the Data Management Agreement), and shall not retain any 
copies of such Contract Data in any form except as set forth in the Data Management Agreement. The 
obligations set forth in the Data Management Agreement shall survive the termination or expiration of 
this Contract and shall continue until such time as the Contract Data is returned to the University or 
destroyed. Upon termination of any Work Order(s) or portion thereof, Contractor shall assist with the 
orderly wind-down and transition up through the effective date of termination, shall promptly provide 
University with all Work Product performed to date in connection with such Work Order (s) or portion 
thereof and shall comply with any applicable provisions of a Data Management Agreement per 
University's direction. 

B. Subject to the Section entitled “Payments Subject to Available Funds”, under Certifications, Attachment 
A, Amendment #1, HIX/IES Special Terms and Conditions (“Available Funds Clause”), upon termination 
of this Contract or any Work Order the University shall, promptly pay the Contractor: 
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i. the applicable fixed fees for all deliverables delivered and finally accepted pursuant to the 
Deliverable Submission and Acceptance process set forth in Attachment B: Scope of Service/Work and 
any previous holdback related to such accepted Deliverables; 

ii. for services and work in progress (including incomplete deliverables wind down services and 
expenses) on a time and materials basis performed prior to the effective date of termination, excluding 
any disputed amounts resulting from Contractor's breach, subject to offset of sums due the Contractor 
against sums owed by the Contractor to the University, and provided. Contractor submits to the 
University a properly completed invoice, with supporting documentation covering such deliverables or 
work in progress, no later than sixty (60) calendar days after the effective date of termination or such 
shorter time as may be required by the applicable HIX/IES Entity funding source. In no event shall such 
time and material amounts exceed the fixed price for the applicable deliverable had such deliverable 
been completed. 

iii. except in the event of termination due to Contractor's breach, Contractor shall be reimbursed for 
(a) the reasonable value of any costs incurred but not amortized in the price of the Contract and (b) 
costs and expenses reasonably incurred by Contractor to terminate its performance of the Services 
earlier than anticipated, including without limitation, costs to terminate any special contracts or leases 
entered into for the purpose of performing the terminated Services; provided such costs and expenses 
were set forth in the Contract or otherwise approved by University in writing and Contractor uses 
commercially reasonable efforts to mitigate any such costs and expenses. Any software, hardware or 
equipment encompassed by this subsection (iii) shall, upon UMMS request, be transferred (e.g,, title, 
license or lease as the case may be) to UMMS, EOHHS or CCA. 

in the event of any impact on shared resources or assets used across multiple Work Orders, any 
impact on another Work Order or a request for transition and wind-down services, as a result of 
termination of a particular Work Order, such impact or request will be addressed in accordance with the 
Change Order process set forth in Attachment B, Statement of Work/Services. 

11. Recordkeeping, Audit, and Inspection of Records: The Contractor shall maintain books, records and other 
supporting documentation to the extent and in such detail as necessary to properly substantiate claims for 
payment under the Contract ("Records"). All such Records shall be kept for a period of seven (7) years or for 
such longer period as is specified herein. All retention periods start on the first day after final payment under this 
Contract. If any litigation, claim, negotiation, audit or other action involving the records is commenced prior to 
the expiration of the applicable retention period, all Records shall be retained until completion of the action and 
resolution of all issues resulting therefrom, or until the end of the applicable retention period, whichever is later. 
The Governor, the Secretary of Administration and Finance, the State Comptroller, the State Auditor, the 
Attorney General, the Federal grantor agency (if any) including without limitation, CMS, the University, or any of 
their duly authorized representatives or designees shall have the right at reasonable times and upon reasonable 
notice, to examine and copy, at reasonable expense, the Records, to the extent necessary to properly 
substantiate claims for payment under the Contract, Such access shall include on-site review, audit and copying 
of Records. 

12. Political Activity Prohibited: The Contractor may not use any Contract funds and none of the services to be 
provided by the Contractor may be used for any partisan political activity or to further the election or defeat of 
any candidate for public office, 

13. Reserved, 

14. Choice of Law: This Contract is entered into in the Commonwealth of Massachusetts, and the laws of the 
Commonwealth, without giving effect to its conflicts of law principles, govern all matters arising out of or relating 
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to this Contract and all of the transactions it contemplates, including, without limitation, its validity, interpretation, 
construction, performance, and enforcement. 

15. Forum Selection: The Parties agree to bring any action arising out of or relating to this Contract or the 
relationship between the Parties in the state courts of the Commonwealth of Massachusetts which shall have 
exclusive jurisdiction thereof. The Contractor expressly consents to the jurisdiction of the state courts of the 
Commonwealth of Massachusetts in any action brought by the University or the Commonwealth arising out of or 
relating to this Contract, or the relationship between the Parties, waiving any claim or defense that such forum is 
not convenient or proper. This paragraph shall not be construed to limit any other legal rights of the Parties. 

16. Force Majeure: Neither Party shall be liable to the other or be deemed to be in breach of this Contract for any 
failure or delay in rendering performance arising out of causes beyond its reasonable control and without its fault 
or negligence. Such causes may include, but are not limited to, acts of nature or of a public enemy, fires, floods, 
epidemics, quarantine restrictions, strikes, freight embargoes, or unusually severe weather. Dates or times of 
performance shall be extended to the extent of delays excused by this section, provided that the Party whose 
performance is affected notifies the other promptly of the existence and nature of such delay. 

17. Risk of Loss: See Section 34 below. 

18. Tax Exempt Status: The University is exempt from federal excise, state, and local taxes; therefore, sales to the 
University are exempt from Massachusetts sales and use taxes. If the University should become subject to any 
such taxes during the term of this Contract, the University shall reimburse the Contractor for any cost or expense 
incurred. Any other taxes imposed on the Contractor on account of this Contract shall be borne solely by the 
Contractor. 

19. Waivers: All conditions, covenants, duties, and obligations contained in this Contract can be waived only by 
written agreement. Forbearance or indulgence in any form or manner by a Party shall not be construed as a 
waiver, nor in any way limit the legal or equitable remedies available to that Party. All waivers shall be in writing. 

20. Amendments: This Contract may be amended only by written agreement of the Parties, executed by the 
Parties' authorized representatives and in compliance with all other regulations and requirements of law. 

21. Reserved. 

22. Reserved. 

23. Reserved. 

24. Non-Disclosure. The following provision shall be in addition to the other security and confidentiality 
provisions contained in the Contract and shall remain subject to and subordinate to, any applicable public disclosure 
laws, including but not limited to the Massachusetts Public Records Law, Mass. Gen. Laws ch. 4 §7 and §26 and ch. 
66 §10. In the event of a conflict, the security and confidentiality requirements set forth in Exhibit H to the MSA 
including but not limited to any requirements for personal health information, personal information, and tax and other 
sensitive data shall supersede and govern over the terms of this Section 24. 

University and Contractor agree that in connection with the performance of their respective obligations hereunder, 
each party may have access to the Confidential Information of the other party, The follow terms will apply to such 
access. 

(a) “Confidential Information”. “Confidential Information” means information belonging to or in the possession of a 
party which is confidential or a trade secret and is furnished or disclosed to the other party under the Contract 
(including information exchanged in contemplation of entering into the Contract): (i) in tangible form and if provided 
by Contractor, marked or designated in writing in a manner to indicate it is confidential or a trade secret; or (ii) in 
intangible form and that either is of a nature that a reasonable person would understand to be confidential or a trade 


CGI Technologies and Solutions Inc. 


00016409vl 


4 


Confidential and Proprietary 
July 2012 




Exhibit B - Prime Contract Flow Down Terms 


secret or is identified as confidential or a trade secret in a writing provided to the receiving party within thirty (30) 
business days after disclosure. 

“Confidential Information” does not include any information that, as evidenced by written documentation: (i) is 
already known to the receiving party without restrictions at the time of its disclosure by the furnishing party; (ii) after 
its disclosure by the furnishing party, is made known to the receiving party without restrictions by a third party having 
the right to do so; (iii) is or becomes publicly known without violation of the Contract; or (iv) is independently 
developed by the receiving party without reference to the furnishing party’s Confidential Information. 

Confidential Information will remain the property of the furnishing party, and the receiving party will not be deemed by 
virtue of the Contract or any access to the furnishing party’s Confidential Information to have acquired any right, title 
or interest in or to the Confidential Information. The receiving party agrees: (i) to use the furnishing party’s 
Confidential Information in accordance with the Contract and afford it at least the same level of protection against 
unauthorized disclosure or use as the receiving party normally uses to protect its own information of a similar 
character, but in no event less than reasonable care; (ii) to limit disclosure of the furnishing party’s Confidential 
Information to personnel furnished by the receiving party to perform Services under the Contract or otherwise having 
a need to know the information for the purposes of the Contract (including without limitation, independent contractors 
working on a party's behalf in connection with the Contract, the IV&V Vendor and subcontractors under written 
obligations of confidentiality at least as stringent as set forth herein); (iii) not to disclose any such Confidential 
Information to any third party except as provided herein; and (iv) to notify the furnishing party promptly of any 
unauthorized use or disclosure of the furnishing party's Confidential Information and cooperate with and assist the 
furnishing party in every reasonable way to stop or minimize such unauthorized use or disclosure. 

If the receiving party receives a subpoena or other valid administrative or judicial notice requesting the disclosure of 
the furnishing party's Confidential Information, the receiving party will promptly notify the furnishing party. Subject to 
its obligations stated in the preceding sentence and any applicable public records laws, the receiving party may 
comply with any valid subpoena or other administrative or judicial process to the extent required by law. 

Upon termination or expiration of this Contract, the receiving party, at the furnishing party’s option, will return or 
destroy all Confidential Information of the furnishing party that the receiving party does not possess under a valid 
license; provided that Contractor and Deloitte Consulting, LLC may retain one (1) and a reasonable number of 
electronic backups of their respective Work Products (including any Work Product or Confidential Information 
contained in working papers) produced under the Contract for archival purposes. 

Each party agrees that if a court of competent jurisdiction determines that the receiving party has breached, or 
attempted or threatened to breach, any of its confidentiality obligations to the furnishing party or the furnishing party’s 
proprietary rights, money damages will not provide an adequate remedy. Accordingly, the furnishing party will be 
entitled to seek appropriate injunctive relief and other measures restraining further attempted or threatened breaches 
of such obligations. 

26. Informal Dispute Resolution, 

A. At the written request of either party, the parties will attempt to resolve any dispute arising under or 
relating to the Contract through the informal means described in this Section 26. The parties agree to 
work together in good faith to resolve any matters relating to the Contract internally by escalating issues to 
Contractor's Contract Manager, the CGI Contract Manager. Each party will furnish to each other all non- 
privileged information with respect to the dispute that the parties believe to be appropriate and germane. 

B. In the event the issue cannot be resolved within a reasonable time by the Contractor's Contract Manager 
and the CGI Contract Manager the issue shall be escalated to Contractor’s Vice President of Sales & 

Client Services and the CGI Vice President, Consulting Services (collectively the “Dispute 
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Representatives”). The Dispute Representatives will negotiate in an effort to resolve the dispute without 
the necessity of any formal proceeding. 

C. Formal proceedings for the resolution of the dispute may not be commenced until the earlier of: (i) the 
Representatives conclude that resolution through continued negotiation does not appear likely; or (ii) thirty 
(30) calendar days have passed since the initial request to negotiate the dispute was made; provided, 
however, that a party may file earlier to avoid the expiration of any applicable limitations period, to 
preserve a superior position with respect to other creditors, to apply for interim or equitable relief, or as 
otherwise required by law. 

D. Reserved. 

27. Non-Solicitation. During the term of the Contract and for twelve (12) months after its expiration or 
termination, neither party will, directly (inclusive of recruitment firms direct solicitation on behalf of a party), solicit for 
employment or employ (except as permitted below) by itself any employee or individual engaged as an independent 
contractor of the other party who was significantly involved in the performance of the party’s obligations under the 
Contract, unless the hiring party obtains the written consent of the other party, The actual damages attributable to a 
breach of the provisions of this Section 27 would be difficult to determine and prove. Accordingly, the parties agree 
that if either party breaches this Section , the breaching party will promptly pay the non-breaching party liquidated 
damages in an amount equal to twenty-five (25%) percent of the employee’s annual salary (including bonuses and 
incentive compensation) prior to the breach, such sum being a reasonable measure of the damages reasonably 
anticipated by the parties. The foregoing provision will not (i) prohibit a general solicitation of employment in the 
ordinary course of business or prevent a party from employing any employee or independent contractor who contacts 
such party as a result of such a general solicitation; or (ii) be read so as to limit employment opportunities to an 
extent that would not be permitted under applicable law, 


_ CERTIFICATIONS _ 

The Contractor makes all certifications required under this Contract , and only as required by law to apply to 
Logicworks under the pains and penalties of perjury, and agrees to provide any required documentation upon request 
to support compliance, and agrees that the following additional terms, to the extent they are applicable to 
Contractor's performance of this Contract and doing business in Massachusetts, are attached or incorporated by 
reference herein: 

Business Ethics and Fraud, Waste and Abuse Prevention. The Contractor certifies that performance under this 
Contract, in addition to meeting the terms of the Contract, will be made using ethical business standards and good 
stewardship of taxpayer and other public funding and resources to prevent fraud, waste and abuse. 

Collusion. The Contractor certifies that this Contract has been offered in good faith and without collusion, fraud or 
unfair trade practices with any other person, that any actions to avoid or frustrate fair and open competition are 
prohibited by law, and shall be grounds for termination of this Contract. 

Public Records and Access The Contractor shall provide full access to records related to performance and 
compliance to the University and officials listed under Executive Order 195 and G.L. c. 11, s.12 seven (7) years 
beginning on the first day after the final payment under this Contract or such longer period necessary for the 
resolution of any litigation, claim, negotiation, audit or other inquiry involving this Contract. Such access to view 
Contractor records related to any breach or allegation of fraud, waste and/or abuse may not be denied and 
Contractor can not claim confidentiality or trade secret protections solely for viewing but not retaining documents. 
Routine Contract performance compliance reports or documents related to any alleged breach or allegation of non- 
compliance, fraud, waste, abuse or collusion may be provided electronically and shall be provided at Contractor’s 
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own expense, Reasonable costs for copies of non-routine Contract related records shall not exceed the rates for 
public records under 950 C.M.R. 32.00 , 

Debarment. The Contractor certifies that neither it nor any of its subcontractors are currently debarred or suspended 
by the federal or state government under any law or regulation including, Executive Order 147: G.L. c. 29, s. 29F, 
G.L. c.30. § 39R . G.L, c.149. $ 27C . G.L, c.149, S 44C , G.L. c.149. $ 148B and G.L. c. 152, s. 25C. 

Applicable Laws. The Contractor shall comply with all applicable state laws and regulations including but not limited 
to the applicable Massachusetts General Laws ; the Official Code of Massachusetts Regulations: Code of 
Massachusetts Regulations (unofficial); 801 CMR 21,00 (Procurement of Commodity and Service Procurements, 
Including Human and Social Services); 815 CMR 2,00 (Grants and Subsidies); 808 CMR 1.00 (Compliance, 
Reporting and Auditing for Human And Social Services); AICPA Standards : confidentiality of Department records 
under G.L. c. 66A; and the Massachusetts Constitution Article XVIII if applicable. 

Payments Subject To Available Funds. The University cannot authorize or accept performance in excess of an 
existing appropriation and allotment, or sufficient non-appropriated available funds. Any oral or written 
representations, commitments, or assurances made by the University or any other Commonwealth representative are 
not binding. The University has no legal obligation to compensate a Contractor for performance that is not requested 
and is intentionally delivered by a Contractor outside the scope of the Contract. The Contractor should verify funding 
prior to beginning performance. If funds are not otherwise made available (including funds which may be received 
from the federal government) for continued performance for any period of the Contract, the Contract may be 
terminated by the University by giving written notice to the Contractor at least ninety (90) calendar days prior to the 
effective date of termination stated in the notice to the Contractor that funds are not otherwise available for 
performance under the Contract; provided, however, that such termination will not affect either the University’s rights 
or the Contractor’s rights under any termination clause in the Contract, The effect of termination of the Contract will 
be to discharge both the Contractor and the University from future performance of the Contract, but not from their 
rights and obligations existing at the time of termination, The University shall notify the Contractor as soon as it has 
knowledge that funds may not be available for the continuation of the Contract. 

Intercept. Contractors may be registered as Customers in the Vendor file if the Contractor owes a Commonwealth 
debt. Unresolved and undisputed debts, and overpayments of Contract payments that are not reimbursed timely 
shall be subject to intercept pursuant to G.L. c, 7A, s. 3 and 815 CMR 9.00 . Contract overpayments will be subject to 
immediate intercept or payment offset. The Contractor may not penalize any state Department or assess late fees, 
cancel a contract or other services if amounts are intercepted or offset due to recoupment of an overpayment, 
outstanding taxes, child support, other overdue debts or Contract overpayments. 

Tax Law Compliance. The Contractor certifies under the pains and penalties of perjury tax compliance with Federal 
tax laws : State tax laws including but not limited to G.L, c, 62C , G.L, c. 62C. s. 49A : compliance with all state tax 
laws, reporting of employees and contractors, withholding and remitting of tax withholdings and child support and is 
in good standing with respect to all state taxes and returns due; reporting of employees and contractors under G.L. c, 
62E , withholding and remitting child support including G.L, c, 119A. s, 12: T1R 05-11; New Independent Contractor 
Provisions and applicable TIRs , 

Bankruptcy, Judgments, Potential Structural Changes, Pending Legal Matters and Conflicts. The Contractor certifies 
it has not been in bankruptcy and/or receivership within the last three calendar years, and the Contractor certifies that 
it will immediately notify the University in writing if there is any risk to the solvency of the Contractor or any potential 
structural changes to its organization, that may impact the Contractor’s ability to timely fulfill the terms of this Contract 
or any amendment. The Contractor certifies that at any time during the period of the Contract the Contractor is 
required to affirmatively disclose in writing to the University contract manager the details of any judgment, criminal 
conviction, investigation or litigation pending against the Contractor or any of its officers, directors, employees, 
agents, or subcontractors, including any potential conflicts of interest of which the Contractor has knowledge, or 
learns of during the Contract term that may adversely impact (i) this Contract (including any amendment thereto), (ii) 
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the HIX/IES Entities, the Commonwealth of Massachusetts, the Federal Government or any employees, agents or 
subcontractors thereto, or (iii) Contractor's eligibility to perform its obligations under this Contract under state or 
federal laws or regulations; provided that Contractor shall not be required to disclose investigations or litigation for 
which Contractor is prohibited by law from disclosing or prohibited from disclosing pursuant to third party commercial 
confidentiality obligations, 

Federal Anti-Lobbying and Other Federal Requirements. The Contractor certifies compliance with federal anti¬ 
lobbying requirements including 31 USC 1352 : other federal requirements ; Executive Order 11246 ; Air Pollution Act : 
Federal Water Pollution Control Act ; Federal Employment Laws; and Section 1311 of the Affordable Care Act, Health 
Insurance Exchange, and 45 CFR Part 74. 

Protection of Personal Data and Information. The Contractor certifies that all steps will be taken to ensure the 
security and confidentiality of all Commonwealth data for which the Contractor becomes a holder, either as part of 
performance or inadvertently during performance, with special attention to restricting access, use and disbursement 
of personal data and information in accordance with G,L, c, 93H and c, 66A and Executive Order 504 . The 
Contractor is required to comply with G.L. c. 931 for the proper disposal of all paper and electronic media, backups or 
systems containing personal data and information, provided further that the Contractor is required to ensure that any 
personal data or information transmitted electronically or through a portable device be properly encrypted using (at a 
minimum) Information Technology Division (ITD) Protection of Sensitive Information , provided further that any 
Contractor having access to credit card or banking information of Commonwealth customers certifies that the 
Contractor is PCI compliant in accordance with the Payment Card Industry Council Standards and shall provide 
confirmation compliance during the Contract, provide further that the Contractor shall immediately notify the 
University in the event of any security breach including the unauthorized access, disbursement, use or disposal of 
personal data or information, and in the event of a security breach, the Contractor shall cooperate fully with the 
Commonwealth and provide access to any information necessary for the Commonwealth to respond to the security 
breach and shall be fully responsible for any damages associated with the Contractor's breach including but not 
limited to G.L, c. 214, s. 3B, 

Corporate and Business Filings and Reports. The Contractor certifies compliance with any certification, filing, 
reporting and service of process requirements of the Secretary of the Commonwealth , the Office of the Attorney 
General or other Departments as related to its conduct of business in the Commonwealth; and with its incorporating 
state (or foreign entity). 

Employer Requirements. The Contractor certifies compliance with applicable state and federal employment laws or 
regulations, including but not limited to G.L, c, 5, s, 1 (Prevailing Wages for Printing and Distribution of Public 
Documents); G.L, c. 7, s. 22 (Prevailing Wages for Contracts for Meat Products and Clothing and Apparel); minimum 
wages and prevailing wage programs and payments : unemployment insurance and contributions; workers’ 
compensation and insurance, child labor laws , AGO fair labor practices ; G.L. c, 149 (Labor and Industries); G.L. c. 
150A (Labor Relations); G.L. c, 151 and 455 CMR 2.00 (Minimum Fair Wages); G.L. c. 151A (Employment and 
Training); G. L. c. 151B (Unlawful Discrimination); G.L. c. 151E (Business Discrimination); G.L, c. 152 (Workers’ 
Compensation); G.L. c.153 (Liability for Injuries); 29 USC c. 8 (Federal Fair Labor Standards); 29 USC c, 28 and the 
Federal Family and Medical Leave Act , 

Federal And State Laws And Regulations Prohibiting Discrimination, The Contractor certifies compliance with 
applicable state and federal laws prohibiting discrimination, including but not limited to including but not limited to the 
Federal Egual Employment Qppurtunitv (EEO) Laws the Americans with Disabilities Act. : 42 U.S.C Sec. 12,101, et 
seg. . the Rehabilitation Act . 29 USC c, 16 s. 794 : 29 USC c. 16. s, 701 : 29 USC c. 14, 623: the 42 USC c. 45: 
(Federal Fair Housing Act); G. L. c. 151B (Unlawful Discrimination); G.L. c, 151E (Business Discrimination); the 
Public Accommodations Law G.L. c. 272, s. 92A ; G.L. c, 272, s. 98 and 98A, Massachusetts Constitution Article 
CX1V and G.L, c, 93, s. 103 ; 47 USC c. 5, sc. II, Part II, s. 255 (Telecommunication Act; Chapter 149, Section 105D, 
G.L. c. 151C, G.L. c. 272, Section 92A, Section 98 and Section 98A, and G,L, c, 111, Section 199A. and 
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Massachusetts Disability-Based Non-Discrimination Standards For Executive Branch Entities, and related Standards 
and Guidance, authorized under Massachusetts Executive Order or any disability-based protection arising from state 
or federal law or precedent. See also MCAD and MCAD links and Resources . 

Northern Ireland Certification. Pursuant to G.L. c. 7 s. 22C for state agencies, state authorities, the House of 
Representatives or the state Senate, by signing this Contract the Contractor certifies that it does not employ ten or 
more employees in an office or other facility in Northern Ireland and if the Contractor employs ten or more employees 
in an office or other facility located in Northern Ireland the Contractor certifies that it does not discriminate in 
employment, compensation, or the terms, conditions and privileges of employment on account of religious or political 
belief; and it promotes religious tolerance within the work place, and the eradication of any manifestations of religious 
and other illegal discrimination; and the Contractor is not engaged in the manufacture, distribution or sale of firearms, 
munitions, including rubber or plastic bullets, tear gas, armored vehicles or military aircraft for use or deployment in 
any activity in Northern Ireland. 

Pandemic, Disaster or Emergency Performance. In the event of a serious emergency, pandemic or disaster outside 
the control of the University, the University may negotiate emergency performance from the Contractor to address 
the immediate needs of the Commonwealth even if not contemplated under the original Contract or procurement. 
Payments are subject to appropriation and other payment terms. 

Subcontractor Performance. The Contractor certifies full responsibility for Contract performance, including 
subcontractors, and that comparable Contract terms will be included in subcontracts, and that the University will not 
be required to directly or indirectly manage subcontractors or have any payment obligations to subcontractors. 


_ EXECUTIVE ORDERS _ 

The Contractor certifies compliance with applicable Executive Orders (see also Massachusetts Executive Orders) , 
including but not limited to the specific orders listed below only as required by law to apply to Logicworks. A breach 
during the period of the Contract may be considered a material breach and subject Contractor to damages under the 
Contract and appropriate monetary or Contract sanctions applicable to Contractor by law and imposed by state or 
government entities. 

Executive Order 481 . Prohibiting the Use of Undocumented Workers on State Contracts . For all state agencies in 
the Executive Branch, including all executive offices, boards, commissions, agencies, Departments, divisions, 
councils, bureaus, and offices, now existing and hereafter established, by signing this Contract the Contractor 
certifies under the pains and penalties of perjury that they shall not knowingly use undocumented workers in 
connection with the performance of this Contract; that, pursuant to federal requirements, shall verify the immigration 
status of workers assigned to the Contract without engaging in unlawful discrimination; and shall not knowingly or 
recklessly alter, falsify, or accept altered or falsified documents from any such worker. 

Executive Order 130 . Anti-Bovcott , The Contractor warrants, represents and agrees that during the time this 
Contract is in effect, neither it nor any affiliated company, as hereafter defined, participates in or cooperates with an 
international boycott (See IRC § 999(b)(3M4) , and IRS Audit Guidelines Boycotts) or engages in conduct declared to 
be unlawful by G.L. c. 151E, s. 2 . A breach in the warranty, representation, and agreement contained in this 
paragraph, without limiting such other rights as it may have, the Commonwealth shall be entitled to rescind this 
Contract. As used herein, an affiliated company shall be any business entity of which at least 51% of the ownership 
interests are directly or indirectly owned by the Contractor or by a person or persons or business entity or entities 
directly or indirectly owning at least 51% of the ownership interests of the Contractor, or which directly or indirectly 
owns at least 51 % of the ownership interests of the Contractor, 

Executive Order 346 , Hiring of State Employees By State Contractors Contractor certifies compliance with both the 
conflict of interest law G.L. c. 268A specifically s. 5 (f) and this order; and includes limitations regarding the hiring of 
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state employees by private companies contracting with the Commonwealth. A privatization contract shall be deemed 
to include a specific prohibition against the hiring at any time during the term of Contract, and for any position in the 
Contractor's company, any state management employee who is, was, or will be involved in the preparation of the 
RFP, the negotiations leading to the awarding of the Contract, the decision to award the Contract, and/or the 
supervision or oversight of performance under the Contract. 

Executive Order 444 , Disclosure of Family Relationships With Other State Employees . Each person applying for 
employment (including Contract work) within the Executive Branch under the Governor must disclose in writing the 
names of all immediate family related to immediate family by marriage who serve as employees or elected officials of 
the Commonwealth. All disclosures made by applicants hired by the Executive Branch under the Governor shall be 
made available for public inspection to the extent permissible by law by the official with whom such disclosure has 
been filed. 

Executive Order 504 . Regarding the Security and Confidentiality of Personal Information . For all Contracts involving 
the Contractor's access to personal information, as defined in G.L. c. 93H, and personal data, as defined in G.L. c. 
66A , owned or controlled by Executive Department agencies, or access to agency systems containing such 
information or data (herein collectively “personal information”), Contractor certifies under the pains and penalties of 
perjury that the Contractor (1) has read Commonwealth of Massachusetts Executive Order 504 and agrees to protect 
any and all personal information; and (2) has reviewed all of the Commonwealth Information Technology Division's 
Security Policies at http://www.mass.gov/anfyresearch-and-tecli/policies-legal-and-teclinical-guidance/it-policies- 
standards-and-procedures/policies-standards-and-procedures-by-category/ (“Security Policies”) Notwithstanding any 
contractual provision to the contrary, in connection with the Contractor’s performance under this Contract, for all state 
agencies in the Executive Department, including all executive offices, boards, commissions, agencies, departments, 
divisions, councils, bureaus, and offices, now existing and hereafter established, the Contractor shall: (1) obtain a 
copy, review, and comply with the contracting agency's, EOHHS’ and/or CCA’s (as applicable) Information Security 
Program (ISP) and any pertinent security guidelines, standards, and policies; (2) comply with all of the 
Commonwealth of Massachusetts Information Technology Division’s Security Policies (3) communicate and enforce 
the contracting agency’s, EOHHS’ and/or CCA’s (as applicable) ISP and such Security Policies against all 
employees (whether such employees are direct or contracted) and subcontractors; (4) implement and maintain any 
other reasonable appropriate security procedures and practices necessary to protect personal information to which 
the Contractor is given access by the contracting agency from the unauthorized access, destruction, use, 
modification, disclosure or loss; (5) be responsible for the full or partial breach of any of these terms by its employees 
(whether such employees are direct or contracted) or subcontractors during or after the term of this Contract, and any 
breach of these terms may be regarded as a material breach of this Contract; (6) in the event of any unauthorized 
access, destruction, use, modification, disclosure or loss of the personal information (collectively referred to as the 
“unauthorized use"): (a) immediately notify the contracting agency if the Contractor becomes aware of the 
unauthorized use; (b) provide full cooperation and access to information necessary for the contracting agency to 
determine the scope of the unauthorized use; and (c) provide full cooperation and access to information necessary 
for the contracting agency and the Contractor to fulfill any notification requirements. Breach of these terms may be 
regarded as a material breach of this Contract, such that the University may exercise any and all contractual rights 
and remedies, including without limitation, indemnification as set forth in Section 9, withholding of payments, 

Contract suspension, termination or other rights and remedies permitted in law or equity. In addition, the Contractor 
may be subject to applicable statutory or regulatory penalties, including and without limitation, those imposed 
pursuant to G.L. c. 93H and under G.L. c. 214, § 3B for violations under M.G.L c, 66A. 

Executive Orders 523. 524 and 526, Executive Order 526 (Order Regarding Non-Discrimination, Diversity, Equal 
Opportunity and Affirmative Action which supersedes Executive Order 478) . Executive Order 524 (Establishing the 
Massachusetts Supplier Diversity Program which supersedes Executive Order 390). Executive Order 523 
(Establishing the Massachusetts Small Business Purchasing Program.) All programs, activities, and services 
provided, performed, licensed, chartered, funded, regulated, or contracted for by the state shall be conducted without 
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unlawful discrimination based on race, color, age, gender, ethnicity, sexual orientation, gender identity or expression, 
religion, creed, ancestry, national origin, disability, veteran's status (including Vietnam-era veterans), or background. 
The Contractor and any subcontractors may not engage in discriminatory employment practices; and the Contractor 
certifies compliance with applicable federal and state laws, rules, and regulations governing fair labor and 
employment practices; and the Contractor commits to purchase supplies and services from certified minority or 
women-owned businesses, small businesses, or businesses owned by socially or economically disadvantaged 
persons or persons with disabilities. These provisions shall be enforced through the contracting agency, OSD, and/or 
the Massachusetts Commission Against Discrimination. Any breach shall be regarded as a material breach of the 
Contract that may subject the Contractor to damages under the Contract and/or appropriate sanctions applicable to 
Contractor by law and imposed by state or government entities. 


_ ATTACHMENT A - UPDATED HIX/IES SPECIAL TERMS AND CONDITIONS _ 

The Contractor's performance shall include services rendered, obligations due, costs incurred, commodities and 
deliverables provided and accepted (by the Massachusetts Executive Office of Health and Human Services 
(“EOHHS”) and the Massachusetts Commonwealth Health Connector Authority (“CCA") as communicated by the 
University) and other commitments authorized under the Contract. A deliverable shall include any tangible product to 
be delivered as an element of performance under the Contract. The University, EOHHS and CCA are jointly entitled 
to ownership and possession of all deliverables created with Contract funds subject to Section 11 of these Additional 
Terms and Conditions. 

1. Reserved. 

2. Reserved, 

3. Reserved. 

4. Reserved. 

5. Confidentialitv/Privacv/Securitv . 

a. The Contractor shall comply with all applicable state and federal laws and regulations and Massachusetts 
Executive Orders relating to confidentiality, privacy and security. In the performance of the Contract, the 
Contractor may acquire or have access to “personal information” (as defined in M.G.L. ch, 93H), or 
“protected health information” (as defined in the Health Insurance Portability and Accountability Act 
(“HIPAA”) Privacy and Security Rules, 45 CFR Parts 160 and 164, as amended), or “personal data” and 
become a “holder” of such personal data (as defined in M.G.L. c, 66A ). Such “personal information,” 
“protected health information" and “personal data” shall be deemed to be “Personal Information.” The 
Contractor shall also protect the physical security and restrict any access to Personal Information or other 
Commonwealth data in the Contractor's possession, or used by the Contractor in the performance of the 
Contract, which shall include, but is not limited to the public records, documents, files, software, equipment 
or systems of the Commonwealth, the University, EOHHS and CCA irrespective of the medium in which it is 
held. 

b. Testing and Development Data 

i, EOHHS and CCA will each be responsible for de-identifying and/or masking their respective 
Contract Data (as defined in Attachment C, Data Management Agreement) to create “de- 
identified data” or “masked data” (each as defined in Attachment C, Data Management 
Agreement) consistent with 45 CFR 164.514, other applicable laws and regulations, and 
providing it to Contractor (directly or via UMMS) as needed during the course of the HIX/IES 
project for testing or development purposes. 

ii, Provided that Contractor (and its subcontractors to the extent their responsibilities involve such 
data) 

a. treats such EOHHS and/or CCA de-identified data or masked data with the standard of 
care required pursuant to the Contract for Contract Data that is not de-identified or 
masked, and 
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b. complies with all security and confidentiality obligations set forth in the Contract, including 
without limitation, those set forth in Attachment A, Updated HIX/IES Special Terms and 
Conditions and Attachment C - Contract Data Management Agreement, 

then, Contractor and its subcontractors shall not be responsible for liabilities resulting from 
such EOHHS or CCA-provided de-identified data and/or masked data if such de-identified 
data and/or masked data fails to adequately de-identify or mask individually identifiable data 
(through no acts of Contractor or its subcontractors) and such error is the cause of the 
liability. 

iii. Contract Data shall not, under any circumstances, be provided to anyone outside of the United 
States, However, de-identified data or masked data that is physically located in the U.S. may 
be accessed by Contractor from outside the U.S., provided that: (i) such de-identified data 
and/or masked data has been de-identified or masked as described by EOHHS or CCA and 
prior written approval of EOHHS (with regards to its de-identified data and/or masked data) 
and CCA (with regards to its de-identified data and/or masked data) for such access has been 
obtained, (ii) such access is limited to Contractor employees or authorized subcontractors 
solely for testing and development purposes under the Contract, and such Contractor 
employees or authorized subcontractors have signed any required security and confidentiality 
agreements required under the Contract and have been trained and informed that any de- 
identified or masked data must be treated as if it is Contract Data with all. required 
confidentiality and security protections, (iii) Contractor’s systems shall be configured with the 
security controls and protections for Contract Data as required under the Contract, (iv) any 
such access does not permit the creation, copying, storage, transmission, use, sharing, 
retention or destruction of such de-identified or masked data outside the United States, and (v) 
UMMS has been copied on all such written approvals granted by EOHHS and/or CCA under 
clause (i) above, 

iv. In the event the Contractor becomes aware that it has access to identifiable Contract Data 
instead of de-identified or masked data for testing and development purposes, Contractor shall 
immediately notify UMMS, cease work with the data, and destroy such data or return it to CCA 
or EOHHS, as applicable, in a secure manner under applicable state and federal laws and any 
instructions as directed by EOHHS and CCA and/or as communicated by UMMS. 

6. Reserved. 

7. Subcontracting By Contractor. Any subcontract entered into by the Contractor for the purposes of fulfilling the 
obligations under the Contract must be in writing, the subcontractor authorized in advance by the University and shall 
be consistent with and subject to the applicable provisions of this Exhibit B and the Contract. Subcontracts will not 
relieve or discharge the Contractor from any duty, obligation, responsibility or liability arising under the Contract. The 
University is entitled to copies of all subcontracts (other than hosting-related subcontracts), with financials redacted, 
for purposes of verifying Contractor's compliance with the Contract and shall not be bound by any provisions 
contained in a subcontract to which it is not a party. With regards to hosting-related subcontracts, the University is 
entitled to copies of all significant subcontracts (with financials redacted) that materially impact Contractor's 
obligations under the Contract, for purposes of verifying Contractor's compliance with the Contract and shall not be 
bound by any provisions contained in a subcontract to which it is not a partyln the event services are in dispute or a 
violation of applicable law is reasonably suspected Contractor shall be obligated to provide aM subcontracts (including 
non-significant hosting subcontracts) in unredacted form. 

8. Affirmative Action, Non-Discrimination In Hiring And Employment, The Contractor shall comply with all federal and 
state laws, rules and regulations promoting fair employment practices or prohibiting employment discrimination and 
unfair labor practices and shall not discriminate in the hiring of any applicant for employment nor shall any qualified 
employee be demoted, discharged or otherwise subject to discrimination in the tenure, position, promotional 
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opportunities, wages, benefits or terms and conditions of their employment because of race, color, national origin, 
ancestry, age, sex, religion, disability, handicap, sexual orientation or for exercising any rights afforded by law. The 
Contractor commits to purchasing supplies and services from certified minority or women-owned businesses, small 
businesses or businesses owned by socially or economically disadvantaged persons or persons with disabilities. 

9. [Intentionally Omitted] 

10. Waivers. Forbearance or indulgence in any form or manner by a party shall not be construed as a waiver, nor in 
any way limit the legal or equitable remedies available to that party. No waiver by either party of any default or breach 
shall constitute a waiver of any subsequent default or breach. 

11. Rights to HIX/IES 

Work Made for Hire; Assignment. All work product developed or generated by the Contractor or its subcontractors 
or agents pursuant to the Contract, including without limitation any and all deliverables, software (both object code in 
executable file format and source code) and related documentation, reports, results, products, programs, routines, 
drawings, studies, specifications, photographs, graphics, artwork, computations, data, inventions-, discoveries, 
improvements, concepts, creative works, designs, techniques and know-how, works of authorship, trade secrets, 
patents, trademarks, copyrights, and any other intellectual property (“Work Product”) is “work made for hire”, or shall 
be considered as having similar status in the United States or elsewhere, and therefore, the University, EOHHS and 
CCA are the author and owners of the Work Product. For the avoidance of doubt, and notwithstanding anything 
herein to the contrary, Contractor or its third party licensors retain all ownership rights in and to Contractor Property 
and COTS products, whether or not any are contained in Work Product, and no ownership rights in such Contractor 
Property and COTS products shall be assigned to University, EOHHS and CCA hereunder even if included in Work 
Product; however, assignment of modifications and enhancements to and derivative works of COTS that are 
generated under the Contract (exclusive of the original COTS contained therein) are included in the assignment of 
rights in Work Product. The Contractor hereby irrevocably and unconditionally sells, transfers and assigns to the 
University, EOHHS and CCA, the entire right, title and interest in and to all Work Product. Such sale, transfer and 
assignment shall be effective immediately upon creation of each deliverable constituting Work Product. In the event 
any Work Product is not considered a “work made for hire”, the Contractor, on behalf of itself and its employees, 
agents, subcontractors and affiliates, does hereby assign, transfer and convey to the University, EOHHS and CCA all 
right, title, and interest in such Work Product. The Contractor shall not affix (or permit any third party to affix) any 
restrictive markings upon any Work Product (except as expressly directed or otherwise authorized in writing by the 
University) and, if such markings are affixed, the University or EOHHS or CCA shall have the right at any time to 
modify, remove, obliterate, or ignore such markings. During the term of this Contract and at any time following 
expiration or termination for any reason of this Contract, upon the request and at the reasonable expense of the 
University, EOHHS and CCA or their nominee and for no additional remuneration, the Contractor and its employees, 
agents, subcontractors and affiliates shall promptly take such action as the University reasonably may request to 
more fully evidence, protect, maintain, secure, register, record, defend, transfer, vest or confirm the University's, 
EOHHS' and CCA's ownership, right, title and interest in the Work Product, 

Residuals. Notwithstanding anything to the contrary contained in this Contract, Contractor, its subcontractors, 
EOHHS, CCA and the University shall not be prevented from using ideas, know-how, concepts, or techniques 
possessed by them prior to, or developed or learned by them outside of, the performance under the Contract, and 
shall each be free to use any Residual Information resulting from their respective performance and/or involvement 
under the Contract. Residual Information shall mean the intangible (i) ideas, (ii) know-how, (iii) concepts and (iv) 
techniques that would be retained in the unaided memory of an ordinary person skilled in the art, not intent on 
appropriating proprietary information. An individual's memory is unaided if the employee has not intentionally 
memorized the information for the purpose of retaining and subsequently using or disclosing it. Nothing in this 
paragraph, however, shall be deemed to transfer ownership of Contractor Property to EOHHS, CCA or the 
University or to transfer ownership of Work Product to Contractor or its subcontractors. 
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IPAWE Agreement The Contractor shall ensure that each of the Contractor's personnel providing services under 
this Contract, regardless of whether the individual is an employee, contractor, or agent of the Contractor, shall, prior 
to rendering any services under this Contract, sign the "Intellectual Property and Work Effort Agreement for the 
Contractor’s Employees, Contractors, Consultants, and Agents” (the “IPAWE Agreement”) which is attached to the 
RFR as Exhibit XV or the substitute agreement set forth in Schedule 1A of this Attachment A, Amendment No. 1, 
HIX/IES Special Terms and Conditions have been pre-approved by the University's counsel (the “Substitute 
Agreement”) in place of the IPAWE Agreement for such personnel. 

Contractor Property. Contractor or its subcontractors or their licensors shall own any works of authorship, materials 
or other intellectual property, all of the foregoing, whether or not incorporated into a Work Product, (I) owned by the 
Contractor or its subcontractors or licensed to the Contractor or its subcontractors by a third party prior to the date on 
which it enters the Contract, (ii) that is independently developed by Contractor or its subcontractor without use of any 
Work Product or confidential information of the HIX/IES Entities, (iii) general purpose consulting tools that are 
independently developed by Contractor or its subcontractor without use of any Work Product or confidential 
information of the HIX/IES Entities for use in performing the services, and (iv) any modifications, enhancements or 
derivatives of the foregoing, excluding modifications and enhancements to and derivative works of COTS that are 
generated under the Contract (collectively, the “Contractor Property”). To the extent Work Product incorporates any 
Contractor Property or Contractor Property is necessary to use the Work Product, the Contractor has obtained for 
the University, EOHHS and CCA a direct grant of rights and otherwise hereby grants, on behalf of itself and any third 
party licensors, to the University, EOHHS and CCA a royalty-free, paid-up, non-exclusive, irrevocable, perpetual, 
worldwide right and license, with the right to sublicense, to use, execute, reproduce, display, perform, distribute 
copies of, modify and prepare derivative works based upon, such Contractor Property, solely in connection with its 
use of the Work Product. This right and license shall include a non-exclusive license under any patent rights that the 
Contractor or any of its third party licensors owns, controls or otherwise possesses a right to grant any rights 
thereunder or thereto, solely in connection with the Contractor Property and its use with the Work Product. 

Contractor shall obtain University's approval prior to incorporating any Contractor Property in the Work Product. Any 
Contractor Property that is intended to be incorporated into the Work Product or is required to use the Work Product 
as of the Effective Date of this Contract, is set forth in Schedule 2 to this Attachment A, Amendment No.1, HIX/IES 
Special Terms and Conditions. To the extent any such Contractor Property has not been identified in Schedule 2 or 
its inclusion is not agreed to in writing prior to its incorporation into Work Product, the Contractor hereby grants to the 
University, EOHHS and CCA all license rights to such Contractor Property to allow the University, EOHHS and CCA 
to use the Work Product consistent with the ownership rights in the Work Product granted to the University, EOHHS 
and CCA in accordance with the Contract. Contractor Property, including general purpose consulting tools created for 
use in performing the services, which are not incorporated into the Work Product and are not necessary, but which 
are reasonably useful for the HIX/IES Entities' use of the Work Product following expiration of the Contract shall be 
made available under mutually agreeable terms. For the avoidance of doubt, Contractor Property is not intended to 
include generally available, third party, administrative COTS tools (e.g. Microsoft Office or Microsoft SharePoint) 
used to deliver reports provided the content of such reports may be accessed without such license. Except for the 
preceding license rights, Contractor retains (on behalf of itself or any applicable third party) all intellectual property 
rights in and to the Contractor Property. 

Federal Exchange Intellectual Property. The parties agree that in the performance of Services under this Contract 
and with the prior written consent of the Department of Health and Human Services, Centers for Medicare and 
Medicaid Services (“CMS”) and the University, it may be desirable for Contractor to leverage certain intellectual 
property developed for and owned by CMS related to the Federal Exchange (“FX"), In such event, CMS retains all 
ownership rights in and to elements of FX provided by Contractor. Contractor will cooperate with the University, 
EOHHS and CCA as reasonably required to facilitate the University, EOHHS and CCA’s receipt of such license 
rights from CMS as are necessary to accomplish the objectives of the Contract, including without limitation, 
reusability for other states and that essentially permit the University, EOHHS and CCA to use such Intellectual 
property as “Work Product” to the extent it is part of the HIX/IES. 
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12. Federal License Rights to HIX/IES 

. The United States Department of Health and Human Services reserves a royalty-free, nonexclusive, and 
irrevocable license to reproduce, publish, or otherwise use and to authorize others to use for federal government 
purposes, any software or modifications thereof and associated documentation designed, developed or installed with 
federal financial participation, provided, however, that this sentence shall not apply to ‘proprietary operating/vendor 
software packages' within the meaning of 45 CFR 95.617(c), except to the extent permitted by Section 11, 

Contractor Property above. Additionally, the United States Department of Health and Human Services reserves a 
royalty-free non-exclusive, and irrevocable license to reproduce, publish or otherwise use and to authorize others to 
use for Federal Government purposes the copyright in any work developed under a grant, subgrant or contract under 
a grant or subgrant, and any rights of copyright to which a grantee, subgrantee or a contractor purchases ownership 
with grant support under 45 CFR § 92.34. 

13. Required Disclosures 

The Contractor shall allow the University and its designees, EOHHS, CCA, and the United States Department of 
Health and Human Services access to the software and all related documentation and records during the system 
design, development, and operation phases of the HIX/IES Project. The Contractor must maintain and retain any 
records necessary to disclose the scope of work performed by the Contractor, as well as any Subcontractors, and to 
substantiate any claims for payment submitted by the Contractor under the Contract. Such records must be, upon 
request, made available and provided to the University and its designees, EOHHS, CCA, the United States 
Department of Health and Human Services, and other government agencies as provided in applicable law. 

14. Warranties 

The Contractor shall represent and warrant to CGI that: 

a. The Contractor and its subcontractors will be sufficiently staffed and equipped to fulfill Contractor’s obligations 
under the Contract; 

b. The Contractor’s services will be performed by appropriately qualified and trained personnel with due care and 
diligence and of quality as is customary in the industry and expected of firms engaged in comparable work, in 
compliance with the Project Schedule and the terms and conditions of the Contract; and in accordance with all 
applicable professional standards for the field of expertise. 

c. The Contractor shall comply with (i) all federal, state and local laws, regulations and guidelines applicable to 
Contractor, which shall include but is not limited to compliance with all privacy laws, regulations and in 
accordance with the Responsibility Matrix,and shall obtain any licenses, permits or registrations necessary for 
Contractor to be able to provide the Services under the Contract; and (ii) all applicable business policies and 
security requirements of EOHHS, CCA and the University that are referenced or cited in the Responsibility Matrix 
Contract, inclusive of the RFR. 

d. All Services delivered under the Contract will substantially conform with the requirements and specifications set 
forth in the Contract, including without limitation, the applicable security and confidentiality requirements 
contained therein. A failure to substantially conform with the Contract requirements and specifications are 
referred to herein as “Nonconformities.” 

e. [Intentionally Omitted]; 

f. Contractor will use commercially reasonable efforts and comply with industry standards to reduce the likelihood 
that any software delivered by Contractor under the Contract is free of Trojan horses, back doors, and other 
malicious code. Notwithstanding the foregoing, if the software is delivered directly to the University as required 
under the Contract, or hosted by a third party other than Contractor or a subcontractor of Contractor, the warranty 
set forth in this subsection (f) shall apply to the software only in the form and at the time delivered to the 
University or such third party hosting entity other than Contractor or a Subcontractor of Contractor, and the 
warranty shall terminate after such delivery; 

g. [Intentionally Omitted]; and 

h. Subject to Section 11, all Services shall be delivered free from any security interest or other lien or encumbrance 
and the Contractor possesses all rights, grants, assignments, conveyances, licenses, permissions and 
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authorizations necessary or incidental to any materials owned by third parties supplied by Contractor for 
incorporation in the deliverables delivered under the Contract. 


Except as otherwise set forth above, the warranty period for the above warranties, shall commence on the 
Commencement Date and shall end on the Contract termination or expiration date (the “Warranty Period”).The 
Warranty Period shall survive expiration of this Contract. In addition, the Warranty Period for any warranty that by its 
nature imposes a continuing obligation on the part of Contractor will survive termination of the Contract. In addition to 
the overall HIX/IES warranties set forth above, each deliverable that is put into production use after acceptance of 
such deliverable by the University, but prior to Contractor meeting the completion criteria, is warranted from the date 
on which it goes into production use until the expiration of the Warranty Period. Expiration of the Warranty Period will 
not relieve Contractor from correcting all Nonconformities arising and reported during the Warranty Period, and any 
Nonconformities resulting from such correction efforts. During all Warranty Periods, the Contractor will remedy any 
Nonconformities without additional cost to the University, EOHHS or CCA. Without limiting Contractor's obligation to 
support Work Product, to the extent Contractor provides third party software and hardware to, or for the benefit or, 
the University, EOHHS and/or CCA, the Contractor must obtain and maintain, for itself and for the benefit of the 
University, EOHHS and CCA warranty, support, and maintenance coverage for all third-party software and hardware 
sufficient to enable it to perform all services required under the Contract. 

Contractor shall have no obligation or liability under this section to the extent a defect results from (a) modifications 
made by CGI (except those directed by Contractor or its subcontractor) or by any third party other than a 
subcontractor of Contractor, (b) the combination, operation or use of the item with other items Contractor did not 
recommend, supply or agree to in writing; (c) the failure of CGI to use any new or corrected versions of the item 
made available by Contractor to CGI and implemented by Contractor, at no cost to CGI; or (d) Contractor's 
adherence to specifications or instructions provided by CGI; provided that such defect would not have occurred 
absent (a), (b), (c) and/or (d). 

Notwithstanding any other warranties set forth in the Contract, Contractor shall use good faith efforts to obtain the 
right to, and to the extent Contractor has the legal right to do so, Contractor agrees to assign or pass through to 
University or otherwise make available for the benefit of University, any manufacturer's or supplier's warranty 
applicable to any third-party software, hardware or equipment provided by Contractor hereunder. Contractor does 
not itself give or make any warranty of any kind with respect to third-party software, hardware or equipment other 
than the enhancements, modifications and derivative works thereto made by Contractor or its subcontractors 
pursuant to the Contract which shall constitute Work Product and shall be covered by the warranties set forth above. 

EXCEPT AS SET FORTH IN THE CONTRACT, CONTRACTOR MAKES NO OTHER WARRANTIES, EXPRESS 
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES OF MERCHANTABILITY AND 
FITNESS FOR A PARTICULAR PURPOSE. 

15. Ownership of Pll and PHI 

All files containing any Massachusetts HIX/IES information, Medicaid information, MassHealth information, 

Personally Identifiable Information (Pll), and/or Protected Health Information (PHI) are the sole and exclusive 
property of the University, EOHHS and CCA. The Contractor shall not use any such data obtained as a result of the 
Contract for any purposes not directly related to this Contract without prior written permission from the University, 
EOHHS and CCA. 

16. [Intentionally Omitted] 

17. Accessibility 

Software and Systems Developed under the Contract. For all Work Products that are to be delivered by 
Contractor under the Contract, the Contractor shall ensure that the Work Products adhere to the ITD Enterprise 
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Information Technology Accessibility Standards and the ITD Web Accessibility Standards (collectively, the 
“Enterprise Accessibility Standards”) issued by Massachusetts’ Information Technology Division (“ITD”) applicable to 
the functionality of the Work Products. 

Addressing Accessibility Problems. For Work Products subject to the accessibility requirements of the Contract, 
the Contractor shall be responsible for curing each instance in which its Work Products fail to comply with the Enterprise 
Accessibility Standards. 

18. Reserved. 

19. System and Data Security. . 

The Contractor shall comply with M.G.L. C, 66A if the Contractor becomes a “holder” of “personal data". The 
Contractor shall also protect the physical security and restrict any access to personal or other EOHHS or CCA data in 
the Contractor's possession, or used by the Contractor in the performance of a Contract, which shall include, but is 
not limited to the public records, documents, files, software, equipment or systems of EOHHS or CCA In addition to 
the foregoing requirements, the Contractor agrees that as part of its work effort under the Contract entered pursuant 
to this RFR, the Contractor may be required to use the following personal data under MGL ch. 66A and/or personal 
information under MGL ch. 93H, or to work on or with information technology systems that contain such data in order 
to fulfill part of its specified tasks. For purposes of this work effort, electronic personal data and personal information 
includes data provided by EOHHS or CCA to the Contractor which may physically reside at a location owned and/or 
. controlled by the University, EOHHS or CCA or the Contractor. In connection with such data, the Contractor will 
implement the maximum feasible safeguards reasonably needed to: 

® Ensure the security, confidentiality and integrity of electronic personal data and personal information; 

® Prevent unauthorized access to electronic personal data or personal information or any other 
Commonwealth Data from any public or private network; 

® Prevent unauthorized physical access to any information technology resources involved in the Contractor's 
performance of a Contract entered under this RFR; 

• Prevent interception and manipulation of data during transmission to and from any servers; and 
« Notify the University, EOHHS and CCA immediately if any breach of such system or of the security, 
confidentiality, or integrity of electronic personal data or personal information occurs, 

20. Corrective Action Plan/Failure to Correct Deficiencies 

If the University identifies, in its reasonable judgment, any systemic or pattern of deficiencies or non-conformities 
Contractor’s compliance with the requirements of the Contract or in the Contractor’s performance under the Contract, 
the University may require the Contractor to develop and submit a corrective action plan to achieve conformity. 
University and Contractor shall use diligent and good faith efforts to agree upon a written corrective action plan which 
shall contain specific deadlines for correction of such deficiencies or non-conformities, within ten (10) Business days 
of written notice of the systemic or pattern of deficiencies or non-conformities. The Contractor shall implement such 
corrective action plan only once the corrective action plan has been agreed upon. The University may require the 
corrective action plan to (1) provide for a subcontract with a subcontractor deemed mutually satisfactory to perform 
specified Contract responsibilities, (2) otherwise alter the manner or method in which the Contractor performs any 
Contract responsibilities, and (3) implement any other action that University may reasonably deem appropriate. If 
the University and Contractor have not, despite diligent and good faith efforts of both parties agreed upon a written 
corrective action plan within such ten (10) business days, the issue will be escalated in accordance with the Informal 
Dispute Resolution process set forth in Section 26 of the Contract For Services Purchased in order to promptly reach 
agreement on the corrective action plan. If Contractor fails to correct any deficiency or non-conformity or fails to meet 
the specific deadlines in the corrective action plan, the University may withhold an amount equal to 5% of the gross 
amount of each invoice submitted thereafter by the Contractor in connection with the applicable deficiency or non¬ 
conformity. When the deficiencies and/or non-conformities are corrected in accordance with the corrective action 
plan, the withheld amounts associated with them shall be released for payment. 

21. Reserved, 
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22. Reserved. 

23. Right to Cover 

The University reserves the right to, subject to Section 36, Limitation of Liability, purchase substantially similar 
substitute services (including warranty services) in good faith and be reimbursed by the Contractor for any excess 
costs over and above the original Contract price for such services (in the case of services that have not yet been paid 
to Contractor) or any excess cost over and above the original Contract price for such services plus any amounts paid 
in advance for the services not provided as a result of the University obtaining such substitute services (in the case 
where payment for services have been previously paid to Contractor), as a remedy when the Contractor breaches 
the Contract by failure to deliver such services in accordance with the Contract and fails to cure the breach pursuant 
to Section 9.B of the Contract; provided, however, that the University shall have the obligation to mitigate the costs of 
procuring such substantially similar services to the greatest extent possible. 

24. Insurance 

The Contractor shall purchase and maintain at its sole cost and expense throughout the term of the Contract 
resulting from this RFR adequate insurance coverage necessary for the performance of the services under the 
Contract, This subsection specifies the required minimum types and amounts of coverage. The Contractor shall 
furnish the University with certificates of the above insurance coverage within ten (10) days of the execution of the 
Contract. Contractor shall provide CGI and the University with thirty (30) days prior written notice of cancellation, 
material change, or non-renewal of the coverage during the term of the Contract. The Contractor’s failure to provide 
or continue in full force and effect the insurance that this section requires shall be a material breach of the Contract 
and may, at the discretion of the University, result in termination. 

The following standard insurance amounts are required at a minimum: 

• Workers' Compensation Insurance providing statutory benefits for persons employed in connection with the 
Contract in accordance with applicable law, including the laws of the state of Massachusetts as well as the laws 
of the state where the Contractor maintains its principal place of business. In addition, Employers Liability 
Coverage with a limit of at least one million dollars ($1,000,000.00) per accident and per disease. 

• Automobile liability insurance covering owned, non-owned, and hired vehicles, with combined limits for bodily 
injury and property damage of at least $1 million per accident. The policy must be endorsed to include the 
University as an additional insured; 

• Commercial General Liability Insurance, including blanket contractual liability, for all damages and claims arising 
out of or related to injury to persons or damages to property which may arise out of or relate to the performance 
of the Contractor's services provided under the Contract. The insurance certificate evidencing the coverage must 
be acceptable to the University and name CGI as an additional insured, with coverage limits of at least 

$1,000,000 per occurrence, $3,000,000 aggregate, If coverage is a claims-made basis, the Contractor shall 
maintain at least three years of reporting endorsement following the expiration of the term of the Contract. 
Contractor shall provide the University with a certificate or other verification of coverage prior to the execution of 
the Contract. Contractor shall provide the University with thirty (30) days prior written notice of cancellation, 
material change, or non-renewal of the coverage during the term of the Contract. 

• Professional liability insurance with limits of at least $1 million per claim and $3 million per aggregate. 

All insurance maintained by the Contractor pursuant to the Contract shall be written by insurance companies licensed 
to do business in the state of Massachusetts. If the Contractor determines that any such insurance needs to be 
placed with surplus lines carriers not licensed by the state of Massachusetts, written permission from the University is 
required. All insurance companies to be used by the Contractor must have a Best’s rating of not less than A- and be 
acceptable to the University. If required by a validly issued subpoena or court order, the Contractor shall produce 
certified copies of the aforementioned policies. 


CGI Technologies and Solutions Inc, 


00016409vl 


18 


Confidential and Proprietary 
July 2012 




Exhibit B - Prime Contract Flow Down Terms 


All insurance maintained by the Contractor shall provide that the insurance for the benefit of the University shall be 
primary and that the University’s own insurance shall be noncontributing. The certificates shall contain an 
unequivocal provision that the University shall be given 30 days' prior written notice of cancellation, material change, 
or nonrenewal of the coverage. 

The Contractor shall cause its subcontractors to purchase, carry, and maintain the minimum types of insurance 
coverage above. 

The Contractor’s and, if applicable, the Contractor’s subcontractor’s failure to provide or continue in full force and 
effect the insurance that this section requires shall be a material breach of the Contract and may, at the discretion of 
the University, result in termination of the Contract, 

25. Reserved. 

26. Conflict of Interest 

During the term of this Contract, the Contractor shall not have any interest that conflicts with the performance of 
services under the Contract. The Contractor acknowledges that, in governmental contracting, even the appearance 
of a conflict of interest is harmful to the interests of Massachusetts and the federal government. Thus, the Contractor 
agrees to refrain from any practices, activities, or relationships that could reasonably be considered to be in conflict 
with the contractor's fully performing its obligations under the terms of the Contract, without the prior disclosure to 
and written approval from the University, EOHHS and CCA, 

In the event the Contractor is uncertain whether the appearance of a conflict of interest may reasonably exist, the 
contractor shall submit to the University's contract manager a full disclosure statement setting forth the relevant 
details for the University, EOHHS and CCA's consideration and direction. Failure to promptly submit a disclosure 
statement or to follow the University's direction in regard to the apparent conflict shall be grounds for termination of 
the Contract. 

27. Publications Regarding or Derived From The Contract 

In the performance of the Contract, the Contractor may develop material suitable for publication under copyright as 
reports, manuals, pamphlets or other forms. To the extent such material is a deliverable in the performance of this 
Contract and is not Contractor Property, such material shall be deemed Work Product made for hire, and the 
University, EOHHS and CCA shall exclusively own the copyright in such material. 

Other material derived from Contractor’s performance of this Contract shall not be published or offered for publication 
through any medium of communication, including press release, without the prior written approval of University, If the 
Contractor or any subcontractor publishes a work dealing with its performance under this Contract, or the results and 
accomplishments attained in such performance, the University shall have a non-exclusive, irrevocable, royalty-free 
license to reproduce, publish or otherwise use and authorize others to use the publication. 

The Contractor shall not disseminate, reproduce, display or publish any report, information, data or other materials or 
documents produced in whole or in part pursuant to this Contract, excluding Contractor Property, without the prior 
consent of the University, nor shall any such report, information, data or other materials or documents be the subject 
of an application for copyright by or on behalf of the Contractor without the prior written consent of the University. 

28. Publicity 

The Contractor may not use its relationship with the University, EOHHS, or CCA for advertising or any form of 
publicity without the University's approval of text and images used in advertising. The Contractor and Deloitte 
Consulting LLP may name the Commonwealth of Massachusetts on a client list and describe in general terms the 
nature of work performed, but may not directly or indirectly represent that a product or service purchased by the 
University from the Contractor is endorsed by the University, EOHHS, or CCA. 


CGI Technologies and Solutions Inc. 


00016409vl 


19 


Confidential and Proprietary 
July 2012 



Exhibit B - Prime Contract Flow Down Terms 


29. Federal Certification and Audits 

At CGI’s expense, the Contractor shall provide reasonable support reasonably necessary in connection with federal 
certification of any portion of the HIX/IES as well as federal and state audits. The Contractor's support may include, 
but is not limited to, providing: 

• Contractor staff; 

• Documentation; 

• Sufficient copies of all output including labeling and cataloging ail output; 

• Computer time; 

• Supplies (both business and computer); and 

» Assistance in responding to any findings including providing detailed work-effort analysis. ■ 

In the event the federal requirements for such HIX/IES certifications and/or audits materially change from the federal 
requirements in effect as of the execution date of this Contract, the parties agree to execute a mutually agreed upon 
change order reflecting such change, The Contractor shall notify the University’s project manager of any action, or 
inaction, by any party known to the Contractor that threatens the timely and accurate completion of any Contractor 
obligation or that it has reason to believe threatens the successful CMS/CCIO certification of the HIX/IES. Such 
notification must be made orally by the close of business on the day of discovery and in writing within three Business 
Days of discovery. 

30. Program Integrity: Medicaid 

The Contractor shall notify EOHHS in writing within ten (10) calendar days if it or, where applicable, any of its 
subcontractors receive or identify any information that gives them reason to suspect that a MassHealth Provider or 
Member has engaged in fraud as defined under 42 CFR 455.2. In the event of suspected fraud, no further contact 
shall be initiated with the Provider or Member on that specific matter without EOHHS’s approval. 

The Contractor and, where applicable, its subcontractors shall cooperate fully with the Office of the Attorney 
General’s Medicaid Fraud Control Unit (“MFCU”) and the Office of the State Auditor’s Bureau of Special 
Investigations ("BSI”), Such cooperation shall, include, but not be limited to, providing at no charge, prompt access 
and copies of any documents and other available information determined necessary by such agencies to carry out 
their responsibilities regarding Medicaid fraud and abuse, maintaining the confidentiality of any such investigations, 
and making knowledgeable staff available at no charge to reasonably support any investigation, court, or 
administrative proceeding resulting from Contractor's notice hereunder of suspected fraud and/or abuse or otherwise 
arising under this Contract. 

31. Protection of Property 

The Contractor shall at all times safeguard University, EOHHS and CCA property from injury or loss in connection 
with the Contract and continuously maintain adequate protection of the Contractor’s work from damage. 

The Contractor shall be responsible for all breakage and damage to property (real and personal) that may occur as a 
result of fault, negligence, or failure to perform on the part of its agents, subcontractors, or employees in connection 
with the performance of the work specified in the Contract. Repair or replacement of any such damage shall be 
commenced by the Contractor within two days after notification of such damage, and shall be completed 
expeditiously to the satisfaction of the University. 

32. Equipment and Facilities. At the University’s discretion, it reserves the right to review and visit the Contractor's 
business location(s) during business hours and subject to Contractor's security policies and procedures regarding 
access to third party confidential information maintained at its facilities, 

33. Reserved. 

34. Risk Of Loss. Except for the negligent errors or omissions of the CGI or the HIX/IES Entities, the Contractor 
shall bear the risk of loss for any Contractor materials used for the Contract and for all deliverables, Commonwealth, 
the University, EOHHS or CCA personal data which is in the possession of the Contractor or used by the Contractor 
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in the performance of the Contract until possession, ownership and full legal title to the deliverables are transferred to 
and accepted by the University. 

35. Contract Boilerplate interpretation. Severability, Conflicts With Law, Integration. If any provision of the Contract is 
found to be superseded by state or federal law or regulation, in whole or in part, then both parties shall be relieved of 
all obligations under that provision only to the extent necessary to comply with the superseding law, provided 
however, that the remaining provisions of the Contract, or portions thereof, shall be enforced to the fullest extent 
permitted by law. All amendments must be executed by the parties in writing in accordance with the terms of 
paragraph 20 of the University’s Contract for Services Purchased. The printed language of the Contract which 
incorporates by reference these HIX/IES Special Terms and Conditions, shall supersede any conflicting verbal or 
written agreements relating to the performance of the Contract, including contract forms, purchase orders or invoices 
of the Contractor. 

36. [Intentionally Omitted! 


SCHEDULE 1-A - PRE - APPROVED SUBSTITUTE AGREEMENT FOR CGI‘S USE WITH ITS 
_CONTRACTORS, CONSULTANTS AND AGENTS 


Independent Contractor Services Agreement 
Intellectual Property Rights Agreement 

The Contractor understands and acknowledges that the ownership and protection of intellectual property and 
confidential and proprietary information is of critical importance to CGI Technologies and Solutions Inc. ("CGI”) and its 
customers. The term “CGI” refers to CGI Technologies and Solutions Inc. and all of its subsidiaries and affiliates, and 
the term “customer” includes all persons or entities for whom CGI performs services or with whom CGI works or 
cooperates for any purpose. This Agreement sets forth certain terms and conditions under which the Contractor will 
perform services for the benefit of CGI or its customers (the "Services”) as part of a project or projects agreed to 
between CGI and Contractor. This Agreement applies in addition to any other agreement between CGI and Contractor 
governing the performance of Services. 

1. Contractor agrees and acknowledges that it may create or participate in the development of inventions, 
discoveries, improvements, and original works of authorship, including, without limitation, derivative, joint, and 
collective works and compilations (collectively, “Works”). The term “Works” includes all ideas or items 
produced or created by Contractor (or any person,furnished by Contractor, if applicable) in the course of 
performing the Services, whether alone or jointly with others. Notwithstanding the foregoing, hCentive retains 
all rights, title and interest in and to its Weblnsure Base and Documentation in all forms and all copies, and 
modifications of the Weblnsure Base and Documentation developed at hCentive’s sole expense, including all 
worldwide rights to patents, copyrights, trademarks and trade secrets in or relating to the Weblnsure Base or 
Documentation. 

2. Contractor will promptly disclose to CGI any Works of which it becomes aware. Contractor agrees that all 
Works that it creates or helps develop under this Agreement will be the property of, and owned by, CGI and 
will be considered “works made for hire”. CGI will have all rights, title and interest in and to all Works, 
including without limitation copyrights, patents, trade secrets, and other proprietary, intellectual, industrial and 
moral rights of whatever nature ("Intellectual Property Rights"). In the event any such Works are, for whatever 
reason, deemed not to constitute a “work made for hire,” the Contractor does hereby assign to CGI all such 
Intellectual Property Rights, for good and valuable consideration, the sufficiency of which is hereby 
acknowledged.. CGI's rights in and to each Work will vest on the date each Work is produced or created. 
Further, as between CGI and Contractor, CGI’s and its customers’ ideas and requirements disclosed to 
Contractor in writing or orally are owned by CGI, Contractor agrees to give CGI at no additional charge all 
assistance reasonably required to vest in CGI throughout the world all Intellectual Property Rights in the 
Works, including without limitation providing written assignments and waivers of such Intellectual Property 
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Rights in favor of CGI, its affiliates and customers from Contractor and the personnel furnished by Contractor. 

If under applicable law Contractor is deemed to retain any rights in any Works, to the maximum extent allowed 
by applicable law, Contractor: 

a) irrevocably assigns to CGI all rights , including Intellectual Property Rights, that it retains; or, if such 
assignment is invalid or insufficient, 

b) irrevocably waives its moral and authorship rights in all Works, including without limitation rights of 
attribution and integrity; or, if such waiver is invalid or insufficient, 

c) consents to CGI's and its customers’ use and infringement of the rights Contractor retains in the 
Works; or, if such consent is invalid or insufficient, 

d) agrees that in perfecting and protecting its rights, Contractor will refrain from interfering with CGI’s 
and its customers' use of any Works. 

3. Contractor will not, without the applicable owner's written permission: (a) reproduce any copyrighted, 
patented, confidential or proprietary material owned by a third party (collectively, “Third Party Materials”), even 
if the material does not carry a copyright or other restrictive notice; (b) provide to CGI or any customer, or 
induce CGI to use or provide, any Third Party Materials; or (c) develop any Works, or provide any advice or 
other services to CGI or its customers, containing Third Party Materials Contractor obtains from sources other 
than CGI, 

4. Contractor acknowledges that a breach, or attempted or threatened breach, by it of any part of this Agreement 
could cause CGI to suffer irreparable injury for which there would be no adequate monetary remedy, and that 
CGI will be entitled (in addition to its other remedies) to obtain injunctive and other conservatory relief. 
Contractor further acknowledges that CGI is an intended third-party beneficiary of this Agreement and shall 
have the right to bring any action, claim, or suit for damages or other relief upon any breach by Contractor of 
its obligations under this Agreement; and CGI shall have the right to assign any or all of its rights under this 
Agreement without Contractor's express consent. 

5. The provisions of this Intellectual Property Rights Agreement are severable, and the unenforceability of any 
one or more provisions will not affect the enforceability of any other provision. If any provision is deemed to be 
or becomes unenforceable, CGI may substitute an enforceable provision that preserves the parties’ original 
intentions and economic positions to the maximum extent legally possible. 

6. The parties agree that Contractor is not an employee of CGI, and nothing in this Agreement shall create or be 
deemed to imply any such relationship between Contractor and CGI or entitle Contractor to any compensation 
from CGI. Contractor acknowledges that a breach, or attempted or threatened breach, by it of any part of this 
Agreement shall be a breach of its obligations to CGI and shall entitle CGI to pursue all lawful remedies 
against Contractor, including immediate dismissal. 


Print Name: 

Signature: 

Date: 
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SCHEDULE 2 - CONTRACTOR PROPERTY AS OF EFFECTIVE DATE OF CONTRACT 


No Contractor Property as of the execution date of the Contract 


SCHEDULE 3 - ACCESSIBILITY WAIVER AND RESPONSE 


[FINAL WAIVER TO BE PROVIDED BY UMMS] 


ATTACHMENT C - DATA MANAGEMENT AGREEMENT 


Section I: Data Management 
(a) Definitions: 

"Contract Data": “Contract Data": As used in this Attachment “C”, “Contract Data” shall refer to any 
information, whether oral, written, or electronic, that constitutes: 

1. personally identifiable data, including without limitation: 

• “personal information" (as defined in Mass. Gen. Laws ch. 93H), 

• “protected health information” (as defined under the Health Insurance Portability and 
Accountability Act Privacy and Security Rules defined below), 

• “personal data” (as defined in Mass. Gen. Laws. ch.66A); 

2. “other state or federal agency sensitive or confidential data” protected under state or federal data security 
or privacy laws or agreements (which may include personally identifiable data from state or federal agencies 
including, but not limited to, the US Internal Revenue Service, Social Security Administration, or 
Massachusetts Department of Revenue)(e.g., adjusted gross income, number of dependents, bankruptcy 
information, tax information, banking account numbers and routing information); and/or 

3. any “de-identified data” (i.e., any personal information, protected health information, personal data or 
other state or federal agency sensitive or confidential data from which personally identifiable information has 
been removed so that there is no reasonable basis to believe that the information can be used to identify an 
individual) or “masked data” (i.e., personally identifiable data for which certain data elements have been 
obscured or masked so that there is no reasonable basis to believe that the masked information can be 
used to identify an individual) 

that the Contractor is given access to, or that the Contractor receives, creates, uses or discloses when 
performing services in accordance with the Contract for Services Purchased (inclusive of all Attachments, 
Amendments and Schedules thereto) made and entered into by the Parties on July 9, 2012 (the “Contract”). 

"Covered Entity(ies)": As used in this Attachment "C" r “Covered Entity(ies)” shall mean the owner(s) of 
the Contract Data. 

"HIPAA": As used in this Attachment ”C" “HIPAA” shall mean the Health Insurance Portability and 
Accountability Act of 1996 at 45 CFR Parts 160 and 164 and its regulations as amended. 

"HITECH Act": As used in this Attachment “C” “HITECH Act” shall mean the Health Information 
Technology Economic and Clinical Health Act provisions in Title XIII of the American Recovery and 
Reinvestment Act (“ARRA”) of 2009. 
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"Security Incident": As used in this Attachment "C" “Security Incident” shall have the same meaning as 
under the HIPAA Security Rule at 45 CFR Parts 160 and 164. 

(b) General Rule(s) for Data: 

1. The Contractor shall not access, store, use, disclose or transmit Contract Data except as permitted by 
Section II: “Contract Data Permitted Activities” of this Attachment "C". 

2. Contractor acknowledges and agrees that it is functioning as the University's subcontractor by 
performing services which the University is obligated to perform for the Covered Entity(ies) 

3. Contractor agrees to remain compliant with HIPAA regulations as amended and the HITECH Act as 
applicable to subcontractors of business associates and further agrees to update this data management 
agreement as required. 

4. Contractor shall comply with all applicable state laws and regulations relating to the confidentiality, 
privacy and security of the Contract Data as well as any applicable state policies including but not 
limited to the Commonwealth of Massachusetts Information Technology Division’s Security Policies 
available at: http://www.mass.gov/anf/research-and-tech/it-pols-stnds-and-quidance/ent-pols-and- 
stnds/securitv-policies-and-standards/ under Policies and Standards, (collectively, “Security Policies”) 

5. Contractor certifies under the pains and penalties of perjury that it has reviewed all such applicable 
state Security Policies and agrees to protect any and all personal information contained in Contract 
Data. 

6. Contractor shall communicateand enforce such Security Policies against all of its employees involved 
in the HIX/IES project (whether such employees are direct or contracted) and Contractor’s 
subcontractors, in both instances, who are involved on the HIX/IES project. 

7. Contractor shall implement and maintain any other reasonable appropriate security procedures and 
practices necessary to protect Contract Data from the unauthorized access, destruction, use, 
modification, disclosure or loss. 

8. Contractor shall be responsible for the full or partial breach of any of these terms of this Attachment ”C" 
by its employees (whether such employees are direct or contracted) or Contractor’s subcontractors 
during or after the term of the Contract, and any breach of these terms may be regarded as a material 
breach of the Contract. 

9. Contractor shall, in the event of any unauthorized access, destruction, use, modification, disclosure or 
loss of the Contract Data (collectively referred to as the “unauthorized use”): (a) immediately notify the 
University, orally and in writing as set out more fully below, if the Contractor becomes aware of the 
unauthorized use; (b) provide full cooperation and access to information necessary for the University 
and the Covered Entity(ies) to determine the scope of the unauthorized use; (c) provide full cooperation 
and access to information necessary for the University, the Covered Entity(ies) and the Contractor to 
fulfill any mitigation and notification requirements; and (d) bear the responsibility and all related costs 
for any security incident or data breach involving Contract Data as determined by the University 
including, associated remedial actions or mitigation steps and consumer notification and related 
responses. 

(d) Data Ownership: The Contractor shall have no ownership rights in the Contract Data, or in any data 
derived or extracted from the Contract Data. 

(e) Security: The Contractor shall implement administrative, physical, and technical safeguards that 
reasonably and appropriately protect the confidentiality, integrity, and availability of the Contract Data, and 
that prevent access to, use of or disclosure of the Contract Data other than as provided for by this 
Agreement. Such safeguards shall include but not be limited to: 

1. The Contractor shall protect from inappropriate use and disclosure any password, user ID, or other 
mechanism or code permitting access to any database containing Contract Data. 
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2. The Contractor shall ensure that only those individuals working on the project involving Contract Data 
shall be provided security roles to access the Contract Data and that such roles are current at all 
times, Contractor shall ensure routine auditing of access to Contract Data and maintenance of 
access logs. 

3. The Contractor shall comply with the security mechanisms and processes established for access to 
all databases necessary to perform services under the Contract, including use of firewall and virus 
checking software, 

4. If the University gives the Contractor access to any University database or any Covered Entity(ies) 
database, the Contractor shall provide the University with a list of personnel who have access to such 
database and shall provide the University with prior notice of any change in personnel whenever the 
change requires a termination or modification of any password, user ID or other access mechanisms. 

5. The Contractor shall ensure that all cached Contract Data will be automatically cleared at the end of 
each user session and shall not thereafter be available for viewing on the local computer. 

6. The Contractor shall ensure that all hardware used to access Contract Data from an off-site location 
shall be used only by Contractor's or its subcontractor's authorized employees and only for 
Contractor's business, provided the University approves such off-site access, and further provided 
such access meets all security requirements under any applicable law or as may be established 
under policies and procedures established by the University and/or the Covered Entity(ies). 

7. CGI shall ensure that all hardware used to access and/or store Contract Data shall be encrypted in 
format meeting standards of the National Institute of Standards and Technology (NIST) and the key is 
held separately and used only by CGI's or its subcontractor's employees and only for CGI’s business. 
AES-256 or equivalent encryption algorithm is acceptable. 

8. The Contractor shall prohibit its employees or Contractor's subcontractors from storing any of the 
Contract Data or copies of the Contract Data on any local hardware device. 

9. The Contractor shall not store the Contract Data on portable media or devices that may be 
transported off Contractor’s premises except when copying data onto storage media for secure 
transport to University or Covered Entity(ies) personnel or for secure transport to Contractor’s backup 
facility, and then only in encrypted format meeting standards of the National Institute of Standards 
and Technology (NIST) and where the key is held separately. AES-256 or equivalent encryption 
algorithm is acceptable. 

10. The Contractor shall prohibit its employees or Contractor’s subcontractors from storing any Contract 
Data or copies of the Contract Data on portable media or devices for any other purpose other than 
that described in # 9 above, unless approved in writing by the University and the devices are 
encrypted in accordance with the NIST standards and the key is held separately. AES-256 or 
equivalent encryption algorithm is acceptable. 

11. CGI shall employ valid encryption processes for all Contract Data at rest and in motion in compliance 
with the NIST standards using AES-256 or equivalent encryption algorithm. For data at rest, 
specified encryption should be Full Disk Encryption (FDE) as opposed to file or volume level 
encryption; for data in motion, protocols (e.g, SSL, SFTP, TLS, IPSec, etc.) using the AES-256 or 
equivalent encryption algorithm, should be employed. 

(f) Inspection: The Contractor shall furnish the University upon request a description of the steps it has taken 
to protect the security of the Contract Data and will allow authorized representatives of the University access 
to the premises where the Contract Data are stored or accessed, for the purpose of inspecting privacy and 
physical security arrangements. 

(g) Non-Secure Transmissions: The Contractor shall not transmit any personally identifiable Contract Data in 
non-secure transmissions over the Internet or any wireless communication device, unless: 1) the Contract 
Data are “de-identified” in accordance with 45 C.F.R § 164.514(b)(2); or 2) encrypted in accordance with 
applicable law, including the American Recovery and Reinvestment Act of 2009 found at: 
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http://www,qpo,qov/fdsvs/Dkq/PLAW-111 publ5/content-detail.html and as required by policies and 
procedures established by the University or the Covered Entity(ies). 

(h) Non-Permitted Use or Disclosure Report and Mitigation Activities: Immediately upon becoming 
aware of any use or disclosure not permitted under this Attachment "C" or any Security Incident, 

Contractor shall take ail appropriate action necessary to: 1) retrieve, to the extent possible, any 
Contract Data used or disclosed in the non-permitted manner; 2) mitigate, to the extent possible, any 
harmful effect known of the non-permitted use or disclosure or Security Incident; and 3) only after 
conferring with the Privacy Officer or designee in the University’s Commonwealth Medicine division 
(“Privacy Officer”) and the University's Office of General Counsel,, take any further action as may be 
required by any applicable state or federal law concerning the privacy and security of the Contract 
Data. Immediately upon becoming aware of the non-permitted use and/or disclosure or Security 
Incident, Contractor shall report to the Privacy Officer, both verbally by phone (508-856-6547) and in 
writing by email (Compiiance@umassmed.edu), and verbally report to the University's Office of 
General Counsel (774-455-7300) the nature of the non-permitted use and/or disclosure, the harmful 
effects of which it is aware, and all actions it has taken or plans to take in accord with this paragraph, 
Thereafter, upon the University's written request, the Contractor shall take such further action as 
required by law and/or deemed appropriate by the University to retrieve the Contract Data and to 
mitigate any harmful effects. 

(i) Response to Legal Process: The Contractor shall report to the Privacy Officer, both verbally by phone 
and in writing by email, as indicated above, any instance where the Contract Data are subpoenaed or 
becomes the subject of a court or administrative order or other legal process, whether or not the Contract 
Data are in Contractor's physical possession, and shall respond as directed by the University. In no event 
shall the Contractor's reporting obligations under this paragraph be delayed beyond the return date in the 
subpoena or legal process, or two (2) business days from obtaining such request for data, whichever is 
shorter. 

(j) Requests by Individuals: Within two (2) business days of receipt, the Contractor shall verbally report to 
the Privacy Officer, as indicated above, any instance where an individual or an individual's legal 
representative makes a request, of either Contractor or a subcontractor or agent of Contractor: (1) for a 
copy of the Contract Data pertaining to that individual; (2) that the Contract Data pertaining to that individual 
be amended; (3) that the Contract Data be disclosed to a third party; (4) a list of disclosures made by 
Contractor of the Contract Data pertaining to that individual. The Contractor shall respond as directed by 
the University. The Contractor shall confirm verbal notice in writing within five (5) business days, 

(k) Copy of Contract Data: The Contractor shall furnish the University with a copy of all or part of the Contract 
Data within two (2) business days of the University's Privacy Officer or his/her designee’s written request. 
The Contractor shall supply the copy in either written or electronic form, as directed by the University. 

(l) Amendment to Contract Data; The Contractor shall amend the Contract Data as directed by the 
University within two (2) business days of the University's request. 

(m) Disclosures to Third Parties: For all disclosures of personally identifiable Contract Data that the 
Contractor makes to third parties, other than to the individual, who is the subject of the data, the individual’s 
personal representative, the University, or the Covered Entity(ies) the Contractor shall document: (1) the 
date of the disclosure; (2) the name of the entity or person who received the personally identifiable Contract 
Data; (3) the address of the entity who received the personally identifiable Contract Data; (4) a description of 
the personally identifiable Contract Data disclosed; and (5) a description of the purpose of the disclosure 
provided, however, that no record of disclosure need be kept if the purpose of the disclosure is for purposes 
of the Covered Entity(ies') treatment, payment or health care operations. If Contractor makes multiple ' 
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disclosures to the same entity for the same purpose, the Contractor shall document the first disclosure as 
above, the frequency of the disclosure, and, if the disclosures are to be discontinued, the date of the last 
disclosure, 

(n) Employee Policies: The Contractor shall adopt employee policies and procedures to ensure that 
its employees comply with the requirements of Sections I and II of this Agreement, Contractor 
agrees that it shall inform and train each of its employees, servants or agents having involvement 
with Contract Data of the laws and regulations relating to security, confidentiality and privacy 
applicable to Contract Data, including provisions contained in this Exhibit B Prime Contract Flow 
Downs. 

(o) Record Access: The Contractor shall make its internal practices, books, policies, procedures and records 
relating to management and control of the Contract Data available to representatives and/or designees of 
the University, or, upon the University’s written request, to the Secretary of the federal Department of Health 
and Human Services. 

(p) Custodian: The Contractor shall designate Paul Jacoby, Vice President of Sales & Client Services as 
custodian of the Contract Data who shall oversee the Contractor’s compliance with Sections I and II of this 
Agreement, and shall notify the University within two (2) business days if the custodianship is transferred to 
another person, 

Section II: Contract Data Permitted Activities 

(a) Underlying Functions or Services: The Contractor shall ensure that each member of its workforce 
accesses, uses, discloses, transmits, or stores the minimum necessary Contract Data and only to the extent 
necessary to perform services under the Contract. 

(b) Agents or Subcontractors: The Contractor may disclose Contract Data to an agent or subcontractor of 
Contractor only with the prior written approval of the Privacy Officer or designee. If such approval is 
granted, Contractor shall ensure that each such agent or subcontractor agrees in writing to the same 
restrictions and conditions that apply to Contractor under this Agreement. Contractor shall be responsible 
for its agents’ and subcontractors' compliance with these restrictions and conditions. 

(c) Disclosures Required by Law: The Contractor may disclose Contract Data if the disclosure is required by 
law, but must notify the Privacy Officer in writing by email, as indicated above, prior to doing so. Such 
notification must include the date of the disclosure, the reason for the disclosure, the entity or person 
receiving the disclosure, and a description of the data being disclosed. 

(d) Use or Disclosure for Contractor Purposes: The Contractor may not use or disclose Contract Data for 
purposes of its own internal management and administrative functions unless it receives prior written 
permission from the Privacy Officer. 


Attachment F 
Amendment No. 2 

Supplemental Terms and Conditions 


1. Reserved. 

2. Reserved. 
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3, In the RFR, Part Four - Laws, Rules, and Guidelines, Section 1(A) is amended by the addition of the following 
paragraph: 

"4. CFR parts 155, 156 and 157 (PATIENT PROTECTION AND AFFORDABLE CARE ACT; 

ESTABLISHMENT OF EXCHANGES AND QUALIFIED HEAL TH PLANS; EXCHANGE STANDARDS 
FOR EMPLOYEES; Final/Interim Rule) (to the extent Final) 

https://www.federalreqister,qov/articles/2012/03/27/2Q12-6125/patient-protection-and-affordable-care- 

act-establishment-of-exchanqes-and-oualified-health-plans 

4, In the RFR, Part Four - Laws, Rules, and Guidelines, Section 1(B) is amended by striking subsection 1(B)(1) and 
replacing it with the following paragraph: 

"7. 45 CFR parts 155, 156 and 157 (PATIENT PROTECTION AND AFFORDABLE CARE ACT; 

ESTABLISHMENT OF EXCHANGES AND QUALIFIED HEAL TH PLANS; EXCHANGE STANDARDS 
FOR EMPLOYEES; Final/Interim Rule) (to the extent Interim) 

https://www.federalreqister.qov/articles/2012/Q3/27/2012-6125/patient-protection-and-affordable-care- 

act-establishment-of-exchanaes-and-gualified-health-plans 

5, Contractor acknowledges that certain data files from the Massachusetts Department of Revenue. Social Security 
Administration and other agencies cannot be accessed without the prior written permission of EOHHS and 
execution of the appropriate confidentiality or other documents required by such agencies. 

6, Without limiting Contractor’s other responsibilities and obligations under the Contract, the additional terms set 
forth in Schedule A - IRS Data Management Requirements to this Attachment F shall apply to the extent 
Contractor or its subcontractors have access to Federal tax information. 


Schedule A 

IRS DATA MANAGEMENT REQUIREMENTS 


I. PERFORMANCE: 

In performance of this Contract, the Contractor agrees to comply with and assume responsibility for compliance by its 
employees and subcontractors with the following requirements: 

(1) All work using any Federal tax returns or Federal tax return information (hereafter referred to as IRS Data) 
will be done under the supervision of the Contractor or the Contractor's employees. 

(2) Any IRS Data made available in any format shall be used only for the purpose of carrying out the provisions 
of this Contract. Information contained in such material will be treated as confidential and will not be 
divulged or made known in any manner to any person except as may be necessary in the performance of 
this Contract. Disclosure to anyone other than an officer or employee of the Contractor, an officer or 
employee of a subcontractor authorized per Section 7 below, or a duly authorized officer or employee of one 
the HIX/IES Entities, will be prohibited. 

(3) All IRS Data will be accounted for upon receipt and properly stored before, during, and after processing, In 
addition, all related output will be given the same level of protection as required for the source material. 

(4) The Contractor certifies that the IRS Data processed during the performance of this Contract will be 
completely purged from all data storage components of its computer facility, and no output will be retained 
by the Contractor at the time the work is completed. If immediate purging of all data storage components is 
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not possible, the Contractor certifies that any IRS Data remaining in any storage component will be 
safeguarded to prevent unauthorized disclosures, 

(5) The Contractor will be responsible for the destruction of the spoilage or any intermediate hard copy printouts 
of IRS Data, and will provide the University or its designee with a statement containing the date of 
destruction, description of material destroyed, and the method used. 

(6) All computer systems receiving, processing, storing, or transmitting IRS Data must meet the requirements 
defined in IRS Publication 1075, To meet functional and assurance requirements, the security features of 
the environment must provide for the managerial, operational, and technical controls. All security features 
must be available and activated to protect against unauthorized use of and access to Federal tax 
information. 

(7) No work using IRS Data under this Contract will be subcontracted, other than to those subcontractors 
named in the Contract, without prior written approval of the IRS. All subcontractors shall agree in writing to 
the IRS Data Management Requirements set forth in this Schedule A, 

(8) The Contractor will maintain a list of employees authorized access. Such list will be provided to the 
University and, upon request, to the IRS reviewing office. 

(9) The University will have the right to terminate the Contract if the Contractor fails to provide the safeguards 
described above. 

(10) The IRS Data Management Requirements set forth in this Schedule A shall be in addition to, and shall not 
limit, any other obligations contained in the Contract. 

II. CRIMINAL/CIVIL SANCTIONS: 

(1) Each officer or employee of any person to whom IRS Data is or may be disclosed will be notified in writing 
by such person that IRS Data disclosed to such officer or employee can be used only for a purpose and to 
the extent authorized herein, and that further disclosure of any such IRS Data for a purpose or to an extent 
unauthorized herein constitutes a felony punishable upon conviction by a fine of as much as $5,000 or 
imprisonment for as long as 5 years, or both, together with the costs of prosecution, Such person shall also 
notify each such officer and employee that any such unauthorized further disclosure of IRS Data may also 
result in an award of civil damages against the officer or employee in an amount not less than $1,000 with 
respect to each instance of unauthorized disclosure. These penalties are prescribed by IRC sections 7213 
and 7431 and set forth at 26 CFR 301,6103(n)-1. 

(2) Each officer or employee of any person to whom IRS Data is or may be disclosed shall be notified in writing 
by such person that any IRS Data made available in any format shall be used only for the purpose of 
carrying out the provisions of this contract. Information contained in such material shall be treated as 
confidential and shall not be divulged or made known in any manner to any person except as may be 
necessary in the performance of the contract. Inspection by or disclosure to anyone without an official need 
to know constitutes a criminal misdemeanor punishable upon conviction by a fine of as much as $1,000 or 
imprisonment for as long as 1 year, or both, together with the costs of prosecution. Such person shall also 
notify each such officer and employee that any such unauthorized inspection or disclosure of IRS Data may 
also result in an award of civil damages against the officer or employee [United States for Federal 
employees] in an amount equal to the sum of the greater of $1,000 for each act of unauthorized inspection 
or disclosure with respect to which such defendant is found liable or the sum of the actual damages 
sustained by the plaintiff as a result of such unauthorized inspection or disclosure plus in the case of a willful 
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inspection or disclosure which is the result of gross negligence, punitive damages, plus the costs of the 
action, These penalties are prescribed by IRC section 7213A and 7431. 

(3) Additionally, it is incumbent upon the Contractor to inform its officers, employees and authorized 
subcontractors, of the penalties for improper disclosure imposed by the Privacy Act of 1974, 5 U.S.C. 552a, 
Specifically, 5 U.S.C, 552a(i)(1), which is made applicable to contractors by 5 U.S.C, 552a(m)(1), provides 
that any officer or employee of a contractor, who by virtue of his/her employment or official position, has 
possession of or access to agency records which contain individually identifiable information, the disclosure 
of which is prohibited by the Privacy Act or regulations established thereunder, and who knowing that 
disclosure of the specific material is prohibited, willfully discloses the material in any manner to any person 
or agency not entitled to receive it, shall be guilty of a misdemeanor and fined not more than $5,000. 

(4) Contractor, its employees and its authorized subcontractors’ access to IRS Data must be preceded by 
certification that each individual understands the applicable security and procedures for safeguarding IRS 
information. Contractors, its employees and its authorized subcontractor must maintain their authorization to 
access IRS Data through annual recertification. The initial certification and recertification must be 
documented and placed in the Contractor's files for review, As part of the certification and at least annually 
afterwards, Contractor, its employees and its authorized subcontractors shall remain current in its 
understanding of the provisions of IRC Sections 7431, 7213, and 7213A (see Publication 1075-Tax 
Information Security Guidelines for Federal, State and Local Agencies: Exhibit 6 of IRC Sec. 7431 Civil 
Damages for Unauthorized Disclosure of Returns and Return Information and Exhibit 5 IRC Sec. IRC Sec. 
7213 Unauthorized Disclosure of Information). The training provided before the initial Certification and 
annually thereafter must also cover the incident response policy and procedure for reporting unauthorized 
disclosures and data breaches. (See Section 10.0 of Publication 1075-Reporting Improper Inspections or 
Disclosures) For both the initial certification and the annual certification, Contractor, its employees and its 
authorized subcontractors shall sign, either with ink or electronic signature, a confidentiality statement 
certifying their understanding of the security requirements. 

III. INSPECTION: 

To verify compliance with these IRS Data Management Requirements, the IRS and the University shall have the right 
to send its officers and employees into the offices and plants of the Contractor (inclusive of its subcontractors) for 
inspection of the facilities and operations provided for the performance of any work under this Contract. On the basis 
of such inspection, specific measures may be required in cases where the Contractor or subcontractors are found to 
be noncompliant with the requirements of this Schedule A. 
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1 Purpose 

The purpose of this section is to outline the Service Level Agreement (“SLA’') between CGI and Logicworks in 
order to define the framework for measuring service delivery by Logicworks in hosting and operating the 
HIX/IES System at the Logicworks Data Center. 

The SLA defines the context and definition of key minimum measures and thresholds mutually agreed upon as 
an objective means to track the Hosting Services and the Service Penalties associated with failure to meet such 
measures and thresholds. 

2 Definitions 


1. “HIX/IES System” or “System” means the HIX/IES application and modules as provided or developed by 
CGI and the Managed Infrastructure hosted by Logicworks. 

2. “At Risk Amount” - A mutually agreed to percentage of the monthly fee paid by CGI to Logicworks 
against which one or more Service Penalties is applied if Logicworks fails to achieve the specified 
Minimum Service Level for a specific Service Metric within the respective Measurement Interval. 

3. “Issue” means a material deviation of the Managed Infrastructure to function per its documented 
specifications. An Issue can be associated with the underlying Managed Infrastructure if it is impacting 
the HIX/IES application and modules. In addition, an Issue can be associated with the performance 
behavior of the HIX/IES application and modules if performance is impacted in a manner that warrants 
initial classification as an Urgent or High Issue (pending investigation of the Issue) because it is materially 
impacting the use of the HIX/IES System in a manner consistent with the Issue Severity Definitions. 
Issues will be initially classified by the party identifying the Issue in accordance with the Issue Severity 
definitions defined herein. Once confirmed by Logicworks, resolution of the Issue will proceed in 
accordance with such classification until Logicworks informs CGI that the Issue has been resolved in a 
notification sent through LogicOps or through the IMC. Any in Severity level shall require the mutual 
agreement of the parties, which agreement shall be reached in a timely, good faith manner in accordance 
with the Issue Severity Definitions elsewhere in this SLA. 

4. “Issue Priority” is the priority of any Issue, mutually agreed to by CGI and Logicworks as described in 
“Issue” paragraph 2 above. This priority indicates, within an Issue Severity level, the relative order in 
which Issues will be handled by Logicworks unless otherwise instructed by CGI. Priority can be defined 
as “Urgent”, “High”, “Medium”, and "Low". 

5. “Issue Severity” is the severity assigned to all Issues, as ultimately managed by Logicworks with input 
from CGI and agreed upon Issue classification as described in “Issue”, paragraph 2 above. After initial 
assignment by the reporting party, this assignment will be reviewed as a coordinated effort between the 
parties based on the definitions of the severities, possible workarounds, and the impact on the 
functionality. The Issue Severity definitions are described in Exhibit A below. 

Exhibit A: HIX/IES Standard Issue Severity Definitions 


Severity 

Definition 

1 - Urgent 

A failure of the Managed Infrastructure has caused, or a foreseeable and likely 
failure of the Managed Infrastructure has potential to cause, the entire System to 
go down or to become unavailable and no workaround is immediately available. 

Use of the System cannot continue. 

Examples include the following to the extent they are caused by a failure of the 
Managed Infrastructure: 

• The HIX/IES System is down and completely inoperable 

• A large number of concurrent users are unable to access Webservers. i.e. 
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2 - High 



HIX/IES users or external end users are experiencing page not found, 
access forbidden or no response from a URL monitored by Logicworks 

• Network outage where the Configuration is not accessible from the Internet 

• Primary and secondary application servers are unavailable thus rendering a 
Managed Server unusable. 

• Internet access to Logicworks’ Datacenter has been interrupted preventing 
all inbound and outbound traffic 

• A large number of concurrent end users are not able to login 

• Anonymous browsing pages such as landing page, shopping are not 
available. 

• Response to critical security alerts. 

Typically Urgent Issues indicate that the System is down hard with no workaround 
and no ability to work in the application. Urgent issues require coordinating an 
Issue Management Call (IMC) with the CGI Service Delivery Manager (SDM) all 
parties require a post incident review and root cause analysis. During an Urgent 
Issue, each party shall provide the other with frequent updates as dictated by the 
IMC. 


A failure of the Managed Infrastructure is directly preventing a large number of 
end users from using the System. High-priority Issues caused by problems with 
the Managed Infrastructure include but are not limited to those that render a site 
monitored by Logicworks unable to function, make key functions of the System 
inoperable, significantly slow processing of data, severely impact a high number 
of end users, lead to federal penalties, misdirect payments, or severely corrupt data 
and any workaround is unacceptable on a long term basis. Essential functions of 
the System are affected by the Managed Infrastructure failure such that there is a 
significant impact to the HIX/IES System. 

Example s include the following to the extent they are caused by a failure of the 
Managed Infrastructure: 

• Major aspects of the HIX/IES System are either down and inoperable while 
some can continue 

• Load balancing not functioning properly thus causing the System to be 
unavailable or inaccessible 

• A large number of errors are reported when end users are executing 
transactions. 

High denotes System not completely down due to a Managed Infrastructure failure 
and/or a temporary workaround can be put in place to “bandage” the issue. 


These problems include those errors caused by a failure of the Managed 
Infrastructure that slow the processing of data by a small degree, render minor and 
non-critical functions of the System inoperable or unstable, and other problems 
that prevent end users or CGI administrators from performing some of their tasks. 

A problem caused by a failure of the Managed Infrastructure that impairs some 
functionality, but a practical workaround exists such that there is not a material 
impact to the HIX/IES System. 

Example: One or more Managed Server processes are impacted, either in 
timeliness or availability, but the HIX/IES System is operational 

These problems include all remaining Service requests made by CGI to 
Logicworks with respect to the Managed Infrastructure, and other problems with 
the Managed Infrastructure that prevent a large number of end users from 
erforming some tasks, but in situations where a workaround is available, fi.e., A 







problem with the Managed Infrastructure that does not affect any production 
functions of the System and may be cosmetic in nature. 

Example: There are some issues with the normal processing caused by a Managed 
Infrastructure Failure, but the HIX/IES System is operational 

6. “Live Date” means the date the HIX/IES System goes into production and is in use by HIX/IES Entities.. 

7. “Managed Server” means a Server that is part of the Managed Infrastructure and that is deployed in a 
redundant group (e.g. . an N+1 configuration) that it has no single point of failure. 

8. “Managed Server Availability” means the Total Uptime of a Managed Server used by CGI and the 
HIX/IES Entities in the HIX/IES System’s production environment, as reported as up and available by 
Logicworks’ monitoring systems and tools. 

9. “Managed Infrastructure” means the Datacenter Facilities and all hardware, software and networking 
components within the Point of Demarcation on which the System operates. 

10. “Managed Infrastructure Availability” means the Infrastructure for which Logicworks is responsible for 
providing to CGI under this Contract, is reported as up and available by the industry standard or 
Logicworks-developed system monitoring tools employed by Logicworks. 

11. “Measurement Interval” is the period of time over which a given Service Metric is measured for purposes 
of determining performance. Measurement Interval is a calendar month unless otherwise specified. 

12. “Minimum Service Level” is the level for a given Service Metric below which is considered a failure in 
Logicworks' performance during the Measurement Interval, which will result in Service Credits awarded to 
CGI by Logicworks. 

13. “Other Outages” are (i) outages that are caused by circumstances outside of Logicworks’ responsibility 
or control; (for example, outages caused by application code content or compatibility, passwords or other 
access rights, legacy systems, CGI’s delays, delays, Force Majeure events, etc.); (ii) outages caused by 
federal or state infrastructure and/or interface problems; (iii) outages necessary to implement emergency 
security patches; (iv) any reasonable action Logicworks is required to take due to violations of the 
Acceptable Use Policy; (v) any reasonable action Logicworks is required to take in reacting to a denial of 
service or other unauthorized attack; or (vi) Emergency Maintenance. 

14. “Planned Outages” are outages that are not “Other Outages” that are documented, approved in writing, 
planned and scheduled in advance including maintenance performed by Logicworks on the Datacenter 
Facilities (e.g., core system maintenance or company-wide maintenance); such approval will not be 
unreasonably delayed or withheld,. 

15. “Point of Demarcation” is the point(s) at the Logicworks Datacenter Facility within which the Managed 
Infrastructure provided by Logicworks is entirely dedicated to CGI and is solely under Logicworks’ 
purview and management. For the Managed Infrastructure, this is the Logicworks-managed network 
device(s) that are the first point in the data path that is dedicated solely to CGI after network traffic has 
transitioned from dedicated third-party telecommunications equipment to the Managed Infrastructure 
components. CGI’s dedicated network begins at that network device(s), but CGI is not responsible for 
maintaining or supporting the actual network device(s) itself. Logicworks is responsible for all support of 
the network device(s) attached to Logicworks provisioned telecommunications circuit(s). 

16. “Provisioned Date” means the date that Logicworks provides CGI with access to the Configuration (as 
defined in the MSA) or when Logicworks informs CGI by email that the Configuration is accessible over 
the Internet and that its password(s) are available. 

17. "Scheduled Maintenance” means the actual maintenance to be provided by Logicworks during any 
Scheduled Maintenance Period, which is mutually prioritized and agreed upon in good faith by 
Logicworks and CGI, including maintenance related to Managed Servers and Managed Infrastructure. 

18. "Scheduled Maintenance Period” is any time when Scheduled Maintenance is to be performed on the 
Configuration. The standard Scheduled Maintenance Period is, unless otherwise agreed, one Saturday a 
month from 11:00 pm ET to Sunday at 5:00 am New York, NY time, although generally not lasting the 
entire period and two additional 2-hour periods to occur between 11:00 p.m. on one or two Saturdays and 
5 a.m. on one or two Sundays. The parties shall use good faith efforts to mutually agree upon such dates 
in a timely and reasonable manner. For the avoidance of doubt, the parties agree that the two additional 
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2-hour periods may occur consecutively thus creating one 4-hour period. The parties further agree that 
should additional Scheduled Maintenance Periods be required in a given month that approval for such 
periods will not be unreasonably withheld. 

"Service Credits” are credits by Logicworks to CGI as a result of a failure by Logicworks to achieve the 
specified Minimum Service Level for a specific Service Metric. The Service Credit is equal to the At Risk 
Amount multiplied by the Service Penalty for the respective Service Metric. This amount is accrued and 
reconciled for each calendar month, and applied to the next applicable monthly invoice by Logicworks. 


“Service Level” is a target for a specific Service Metric against which Logicworks' performance is to be 
measured and reported. “Service Levels” are the collective set of Service Levels across the respective 
Service Metrics, specifically including the Minimum Service Level. 

21. “Service Metrics” are the specific units of measure mapping to the objectives for which Service Levels are 
established (as further defined in this SLA). 

22. “Service Penalty” is the amount for each Service Metric that is factored against the At Risk Amount for 
purposes of calculating any Service Credits relative to the applicable Service Level(s) during a given 
Measurement Interval. 

23. "Total Planned Uptime” refers to the total minutes in the month of Managed Infrastructure Availability or 
Managed Server Availability, as applicable. Managed Infrastructure Availability and Managed Server 
Availability are measured 24/7/365 based on the number of minutes in the calendar month being 
measured, Total Planned Uptime excludes (i) Scheduled Maintenance; (ii) Other Outages; and (iii) any 
Planned Outages specifically agreed by the parties in writing as excluded from Total Planned Uptime. 

24. “Total Uptime” refers to the total minutes in the month of actual Managed Infrastructure Availability and 
Managed Server Availability as applicable. Total Uptime equals Total Planned Uptime minus 
unscheduled outages (or “Downtime”), which are determined by incidents reported by either party 
resulting in an Issue, excluding Issues for which Logicworks does not have responsibility under the 
Contract. 

25. “Uptime Percentage” refers to the percentage of minutes that the Managed Infrastructure or Managed 
Server, as applicable is available is calculated as follows: 

The calculation is: Uptime Percentage = (Total Uptime / Total Planned Uptime). 


3 Scope of Applicability 


Detailed Explanation as to When and How the SLA Applies 




i ■ .. 


1. While not specific to a Service Metric, Logicworks availability in support of delivering the Hosting Services 
and the SLA is as follows: 

Logicworks and CGI staff on-call 24/7/365 for the HIX/IES System production application Urgent and High 
Issues 


CGI staff on-call from 8:00 a.m. to 8:00 p.m. on business days for the HIX/IES System non-production 
application Urgent and High Issues. CGI’s service delivery manager will be on call 24/7/365.. 

2. The Service Metrics and Levels are applicable to Managed Servers and the Managed Infrastructure, as 
appropriate for each Service Metric. Creation of data/Content to be sent to Logicworks or processing 
data returned by Logicworks are the responsibility of CGI. 

3. The Service Metrics and associated Service Levels apply to the Configuration and use thereof, unless 
specifically noted otherwise. In the event that a single Issue affects more than one Service Level, only 
the Service Metric with the highest Service Penalty will apply with respect to any Service Credits issued 
by Logicworks to CGI. However, other unrelated incidents resulting in Issues will be considered as 
separate events and aggregated with respect to measuring performance against each Service Metric and 
associated Service Levels. 

4. CGI and Logicworks will coordinate Scheduled Maintenance Periods at least two (2) calendar weeks in 
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Detailed Explanation as to When and How the SLA Applies 


advance. Exceptions may be needed if a situation arises that puts achievement of the target Service 
Metrics and associated Service Levels at risk, hence jeopardizing expected operations of the System. 
Such maintenance shall be timed to coincide with times of minimal traffic or use of the HIX/IES System. 
Logicworks reserves the right to immediately request and institute a Scheduled Maintenance Period at 
any time of the day if Logicworks reasonably determines that a failure to act immediately would lead to 
significant harm to either Logicworks or CGI. Every reasonable effort will be made to obtain CGI’s prior 
approval of such action in writing. Scheduled Maintenance Periods under these circumstances cannot 
be associated with an Issue or a situation that Logicworks could have reasonably been expected to 
mitigate within Logicworks’ boundaries of responsibility under this SOW. 

5. Any events or situations affecting the System for which Logicworks is not responsible will not be counted 
toward Logicworks’ ability to achieve the Minimum Service Level(s) associated with the respective 
Service Metric(s). This includes (i) acts, errors, or omissions of CGI or any of its suppliers or contractors; 
(ii) any failures caused by Collocated Devices, (iii) the inability of Contractor to take corrective action 
without violating government instructions or procedures; (iv) failure of any hardware or software no longer 
being supported by the manufacturer and for which reasonable time has not been provided during a 
Scheduled Maintenance Period or Planned Outage to upgrade such hardware or software; or (v) 
insufficient hardware, software, or telecommunications resources required to meet CGI’s needs, and for 
which CGI did not agree to either upgrade or provide additional resources despite Contractor’s 
appropriately justified and substantiated recommendation. 

6. If Logicworks is waiting on CGI for additional necessary information requested by Logicworks during 
resolution of an Issue, measurement of Logicworks’ non-conformance with the respective Service Metric 
and associated Service Levels being impacted is suspended until CGI’s response with the requisite 
information is received. Once Logicworks makes available a fix or correction to remediate an Issue 
impacting one or more Service Metrics, measurement of Logicworks’ non-conformance with the 
respective Service Metric and associated Service Levels being impacted ends. As an example, 
Logicworks is not responsible for additional time associated with subsequent CGI required approvals or 
procedures related to the application of the fix or correction. If, upon application of the fix or correction, 
the Issue is not remediated, Logicworks will again be subject to measurement of non-conformance 
against the Service Metric, upon notification by CGI to Logicworks or acknowledgement by Logicworks to 
CGI of the new or continued situation. Unless otherwise agreed to by both parties, if notice is by the end 
of the following Business Day after Logicworks delivers an applied fix or correction to CGI for CGI to test, 
continuation of resolution time will be against the original Issue and resolution time will begin to accrue 
again upon CGI’s notification, otherwise a new Issue is logged. However, none of these situations 
relieve Logicworks from responsibility to support resolution or remediation of a situation if any part of the 
cause or ability to resolve fall within Logicworks’ responsibilities as set forth herein. 

7. Service Metrics and associated Service Level calculations as well as Service Credits will be suspended 
during an active Force Majeure. In the event of a Disaster Recovery scenario, as mutually agreed by 
Logicworks and CGI in writing, only the Disaster Recovery metrics shall apply. 

8. Logicworks requires devices to be purchased and configured in redundant pairs or N+1 redundant groups 
in order to qualify for SLA for the Production environment. 

9. For the purposes of replacing a failed device, the time required to restore data from backups, reformat 
disks or RAID arrays, reload or configure operating systems, is not included. 

10. Logicworks monitoring, measurement, and responsibility will be within the Point of Demarcation. 

11. Downtime and Incident Response times will be measured from the first to occur of the following: (A) 

Client reports the Downtime or Issue by submitting a ticket through LogicOps; (B) Client reports the 
Downtime or Issue by calling Logicworks’ network operations center; and (C) Logicworks monitoring tools 
detect the Issue or Downtime and generate an alert. 

12. If there is a Managed Server or Managed Infrastructure component failure that does not impact the 
production HIX/IES System availability, i.e. failover and/or high availability masks the problem from the 
end clients, then the Environment Metrics are not impacted. 
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1. Logicworks shall implement and utilize its current measurement and monitoring methods, tools, and 
procedures to track and report Logicworks’ performance in delivering the Hosting Services relative to the 
applicable Service Levels to the extent necessary to produce a monthly report. 

2. The monthly report will be delivered for the Services on a monthly basis as per the agreed upon invoicing 
schedule. The report measures and documents the performance of Logicworks' Services relative to the 
Service Levels and CGI’s usage of Services. The report details the Service Metrics relative to the Service 
Levels, the actual measured level of performance for each Service Metric, and any resulting monthly 
Service Credits. If CGI believes, based on data obtained via its own monitoring, that Logicworks did not 
achieve the Minimum Service Level for any of the Application Metrics, CGI will use commercially 
reasonable efforts to notify Logicworks within 15 business days from receipt of the monthly report 
provided by Logicworks indicating the respective Minimum Service Level was achieved to question in 
writing Logicworks’ associated and reported performance. 

Should CGI question Logicworks performance as noted above, Logicworks and CGI agree to jointly, 
objectively, and in good faith, to review each party's monitoring data as applicable to Logicworks’ 
responsibilities within the Point of Demarcation herein within thirty (30) days following receipt of CGI’s 
assertion. If Logicworks and CGI do not reach agreement, CGI may invoke the process outlined in 
Section 26 (Informal Dispute Resolution) of the Prime Contract Flow Downs and would inform Logicworks 
in writing of its intent to do so within ten (10) business days following the thirty (30) day period. 

3. In all cases, Logicworks will be responsible for measuring Service Levels with industry standard tools and 
providing CGI appropriate Service Credits based on calculations as set forth in this SLA. 

4. The initial measurement Interval for purposes of calculating Service Credits begins with the date indicated 
in the applicable row of the “Start Date of SLA Metric Measurement” column set forth in Section 5 Service 
Metrics and Service Levels chart below. Notwithstanding the absence of Service Credits during these 
periods, Logicworks will continue to remain subject to all its other obligations as set forth in this SLA. 


Service Metrics and Service Levels 


If Logicworks performance falls below the identified Minimum Service Level, CGI would be entitled to the associated 
percentage of the At Risk Amount (based on the Service Penalty) as a Service Credit to be accrued and reconciled 
monthly. The Service Credit is capped and shall not exceed an At Risk Amount of 20% of the monthly fees paid to 
Logicworks for any and all failures during the Measurement Period in which Logicworks’ respective performance was 
below the Minimum Service Level. In no month will the aggregate Service Credit for all failures be greater than this 
amount. To the extent that an Issue requires a software correction to the HIX/IES System to remedy, Logicworks is 
relieved of the corresponding Service Penalty under this Section 5. 


Exhibit C: Service Metrics 


Service 

Metric 

Category 

Service 

Penalty 

Environment Metrics 

Managed Server 
Availability to the 
extent caused by 
Managed 
Infrastructure 
issues or failures 

Uptime Percentage 

50% 

Managed 

Infrastructure 

Availability 

Uptime Percentage 

50% 


Service Level 


Environment 


Start Date of 
SLA Metric 
Measurement 
and Service 
Credit 



Production Only Live Date 


Production 


Live Date 


UAT and Training Provisioned Date 

































Application Metrics 

HIX/IES 

Application 

Performance 


Transaction 

Performance 


Eastern Time Zone 


This Service Metric applies to 
LogicWorks if transaction 
performance is impacted and 
CGI is assessed with a Service 
Penalty for this Service Metric to 
the extent that the root cause is 
a hardware fault or failure 
(excluding Collocated Devices). 

CGI transactions will be 
impacted if, as reported by the 
CGI monitoring tools, the 
following response times are not 
achieved: 


Simple 

Transactions 

Complex 

Transactions 


1.45 

seconds or 

less _ 

2.5 

seconds or 
less 


Approach to determining 
Response Time : For online web 
based access, the response 
time will be measured as the 
interval from the time the end 
point web server receives each 
individual user request to the 
time a response is sent back 
from the web server, as 
averaged for each hour. For 
example, if the user presses the 
'Submit’ button, the calculation 
shall commence from the time 
the end point web server 
receives the request to the point 
when the web server returns the 
request. External network time 
shall not be included in this 
calculation. 


Issue Notification Metrics 


Urgent & High 



Notification 

20% 

Begin review and diagnosis 
within 1 hour of receipt of Issue. 

Production (All 
Issues) 

.Live Date 



Urgent: Resolution efforts begin 
upon notification and continues 





24x7 until resolved. Urgent 

Issue resolution time will be 
based on complexity as follows: 

UAT & Training 

Provisioned Date 



High 

8 Business 
hours 

(Infrastructure 

Issues Only) 




Medium 

4 Business 

Hrs 





Simple 

4 Business 

Hrs 





High: Resolution efforts begin 
after Urgent Issues are resolved 
in consideration of Issue 

Priority. High Issue resolution 
time will be based on complexity 
as follows: 































Provisioning Metrics 
Physical Servers 


Virtual Machines 


Infrastructure 
Request queue 
Quantity: 1-5 
Quantity: 6-10 
Quantity: 10+ 


Infrastructure 
Request queue 
Quantity: 1-5 
Quantity: 6-10 
Quantity: 10+ 



4 Business 
Hrs 


4 Business 
Hrs 


Should a temporary work 
around be available, it should 
be provided as soon as 
possible. 


Begin review and diagnosis 
within 4 hours of receipt of 
Issue. 

Medium: Resolution efforts 
begin after Urgent and High 
Issues are resolved and in 
consideration of Issue Priority. 
Medium Issue resolution time 
will be based on complexity as 
follows: 



High 

18 hours 

Medium 

12 hours 

Simple 

6 hours 


UAT, Training 
(Infrastructure 
Issues Only) 


Low: Resolution efforts begin 
after Urgent, High, Medium 
Issues are resolved and in 
consideration of Issue Priority. 
Low Issue resolution time will be 
based on complexity as follows: 


High 

3 Business 
Days 

Medium 

2 Business 
Days 

Simple 

ft1 



Managed Services Infrastructure 

for Virtual Request 


Resource available within: 

10 Business Days of receipt of 
executed Service Order 
20 Business Days of receipt of 
executed Service Order 
According to agreed project 
plan 

Resource available within: 

2 Business Days of receipt of 
executed Service Order 
4 Business Days of receipt of 
executed Service Order 
According to agreed project 
plan 


Managed Services double 
provisioning times for VMs 



Executed Service 
Order 














































JK$8SSB§ 


Machines 
(monitoring, 
alerting, backups) 


SAN Storage 

Infrastructure 

Request 

involving existing 

LUNS (e.g., adding 
storage'mount points 
within an existing 

LUN configuration) 

SAN Storage 

Infrastructure 

Request that 
modifies storage 
configurations (e.g. 
new LUNs, or LUNs 
changes that require 
a maintenance 
window) 



5% 

Resource available within 1 
Business Day of receipt of 
executed Service Order 

5% 

Resource available within 5 
Business Days of receipt of 
executed Service Order 



Executed Service 
Order 


Executed Service 
Order 


Limitations on provisioning credits: 

a) Provisioning requests designated as affecting production will be expedited. 

b) Virtual Machines must be deployed from approved templates. VMs that are deployed from approved templates may not require the 
full provisioning time above. 

c) Provisioning times are measured end-to-end beginning from when the executed Service Order is received by Logicworks and ending 
upon acceptance by CGI. Time waiting for CGI's review, approval and acceptance Is not included In this measurement. 

d) Maintenance or change management times are not calculated (e.g., change management times related to request preparation 
(change management meetings) and execution (scheduling and approving maintenance windows)). 

e) Provisioning of resources such as VMs may, for practical purposes, require additional physical servers (hosts) or more extensive 
upgrades such as storage or networking components. These dependencies must be excluded in calculating Provisioning Metric 
calculation. 

f) Any Infrastructure Requests that require third-party components may involve procurement time from those third-parties that will be 
excluded from the Provision Metric calculation. 



10% 

Within 6 hours of a declaration 
of disaster 

Production Only 

Live Date 

10% 

Within 12 hours of a declaration 
of disaster 

Production Only 

Live Date 

5% 

No greater than 30 minutes loss 
of data 

Production Only 

Live Date 


Disaster Recovery Targets 


Recovery Time Restoration 
Objective (RTO) 

(Infrastructure) 


Restoration 


Restoration 


General Metrics 


(1) Target Customer (CGI) Status Update Time is as follows or as mutually agreed upon between the parties during an Issue 
Management Call. Urgent progress updates shall be every 30 minutes or as mutually agreed and High Issues progress 
updates shall be, every 2 hours, low and medium Issues progress updates shall be weekly. A reasonable workaround 
would trigger re-evaluation of the respective Severity. Should an Issue arise that cannot reasonably be addressed within 
the Target timeframe, both parties agree to collaborate on a mutually agreed upon action plan that will then govern its 
resolution. 

(2) The’ times set forth for issue response time metrics shall commence upon the earlier of the time at which CGI gives 
notice to Logicworks via the contact point, or Logicworks identifies the Issue. 

(3) Low Severity Issues will be undertaken with priority as soon as possible upon receipt of such requests if associated with 
resolution of Urgent or High Issues. 
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ACCEPTABLE USE POLICY 

1. General. This Acceptable Use Policy sets forth guidelines for the acceptable use of Logicwarks' 
network. All Subscribers to Logicwarks' services are required to comply with this policy. 

2. Illegal Use. The Logicworks network may only be used for lawful purposes. Transmission, 
distribution or storage of any material in violation of any applicable law or regulation is prohibited. This 
includes, without limitation, material protected by copyright, trademark, trade secret or other 
intellectual property right used without proper authorization, and material that is libelous, defamatory, 
constitutes an illegal threat, violates export control laws or regulations or Encourages conduct that 
would constitute a criminal offense or give rise to civil liability. 

3. System and Network Security. Violations of system or network security are 
prohibited. Examples of system or network security violations include, without limitation:Da, 

Unauthorized access to or use of data, systems or networks, including any attempt to probe, scan or test 
the vulnerability of a system or network or to breach security or authentication measures without 
express authorization of the owner of the system or networkDb, Unauthorized monitoring of data or 
traffic on any network or system without express authorization of the owner of the system or 
networkfk Interference with service provided to any user, host Dr network including, without limitation, 
mailbombing, flooding, computer worms or viruses, deliberate attempts to overload a system and 
broadcast attacks andDd. Forging of any tcp-ip packet header or any part of the header information. 

4. Abuse. The following acts are considered to be abusive of the Logicworks network and are 
prohibited:Oa. Any conduct which violates the accepted norms and expectations of the Internet 
community at large including, without limitation, posting or distributing information or materials which 
are abusive or threatening. Logicworks reserves the right determine, in its sole discretion, whether any 
particular conduct violates such norms and expectationsDb, Resale of any Logicworks services or 
products unless expressly authorized in writing by LogicworksDo. Falsifying Subscriber information in 
applications, contracts and other materials provided to Logicworks including fraudulent use of credit 
card numbers or "bill to" numbersDd. Falsifying identity or contact information to circumvent this 
Acceptable Use Policy or otherwiseQe. Forging of message headers or a sender's identity, or taking any 
similar action with the intent of bypassing restrictions or limits on access tQ a specific service or siteDf. 
Creating, forwarding, posting or distributing chain messages of any type (also known as "pyramid" or 
"ponzi" schemes) andDg, Attempting to circumvent or alter the processes or procedures to measure 
time, bandwidth utilization or other methods to document use of Logicworks services. 

5. E-mail. Logicworks prohibits Subscribers from engaging the following e-mail related 
activitiesUa. Sending unsolicited bulk e-mail ("UBE", or "SPAM"). This includes but is not limited to the 
distribution of UBE for commercial, informational, advertising, political, or religious purposesDb. Setting 
up "mailback" or "drop box" addresses in order to receive responses from UBE, either directly by the 
Subscriber or by a third party on behalf of the Subscriber andOc. Engaging in any of the foregoing 
activities by using the service of another provider, but channeling such activities through a Logicworks 
account, remailer, or otherwise through a Logicworks service or using a Logicworks account as a 
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maildrop for responses or otherwise using the services of another provider for the purpose of 
facilitating the foregoing activities if such use of another party's service could reasonably be expected to 
adversely affect a Logicworks service.Od. Running a mail server with open relay, i.e. which allows the 
unchallenged forwarding of e-mail. Logicworks reserves the right to implement technical mechanisms 
which block UBE before it is forwarded or otherwise sent to its intended recipients. 

6, Compromised Servers or Network Equipment, Logicworks prohibits the 
continued operation of servers that have been compromised by third parties or automated agents. 

7, World Wide Web, Logicworks prohibits Subscribers from engaging in any of the following 
web-related activities:Oa, Exploiting or attempting to exploit any scripts presented on a web pageDb, 
Utilizing programs, scripts or commands to abuse a web site, e.g. by using bandwidth excessively andDc. 
Hosting a web page which acts maliciously against users that visit that page. 

8, Indirect Violations, INDIRECT OR ATTEMPTED VIOLATIONS OE THE POLICY. AND ACTUAL OR 
ATTEMPTED VIOLATIONS BY A THIRD PARTY ON BEHALE OF A SUBSCRIBER OR A SUBSCRIBER'S END USER 
SHALL BE CONSIDERED VIOLATIONS OF THE POLICY BY SUCH SUBSCRIBER DR END USER. 

9, Reporting. Subscribers to Logicworks 1 services are required to immediately report to 
Logicworks (i) any event or issue which could compromise the stability, service or security of the 
Logicworks network and (ii) any known violation of this Acceptable Use Policy. 

10, Intentionally Omitted, 

11, Intentionally Omitted. 

12, Complaints/Questions. Complaints or questions regarding this Acceptable Use Policy 
should be sent to abuselDLogicworks.net. 
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LOGICWORKS TECHNICAL POLICIES 

The technical policies set forth below (Logicworks™ Technical 
Policies) are incorporated by reference in Logicworks™ Master 
Service Agreement (the MSA). Capitalized terms which are used 
but not defined in Logicworks™ Technical Policies shall have the 
meanings given them in the MSA or the Hosting Agreement. 


Operating Systems 

0 Windows support is limited to Windows 2003 and later. 

■ Linux support is restricted to Red Hat Enterprise Linux 4.0 and later. 

0 New hardware may require most recent versions of vendor operating systems due to 
hardware/driver support. 

B While clients may choose to schedule the deployment of Operating System Vendor patches, those 
patches must be applied in a commercially reasonable time frame. 

Storage 

0 System disks are either software mirrored RAID 1 or SSD (solid-state drive). 

E Due to extended array rebuild times and the potential for failure of a second disk during rebuilds, 
Logicworks supports RAID I and RAID 10 only for storage subsystems. 

B SATA disks are not supported for I/O intensive production servers. Only SCSI or SAS are supported 
for I/O intensive applications. 

■ Each server, storage array, or partition (if applicable) shall have adequate space for Clients data files, 

log files, and backups, and must maintain adequate disk space for projected ninety (9D) day 
growth so as tD not exceed a threshold of 85% total disk usage, 

0 Arrays must contain a hot spare per LUN„ 

■ Custom partitioning schemes are subject to Logicworks™ Senior Engineering approval. 

Security & Administration 

0 Client must communicate any changes of a given server's role to Logicworks (e.g„ installing a 
database management system on a Web server). 

0 Passwords must conform to generally-accepted best security practices, i.e„ must include non- 

alphanumeric characters, cannot be easily-guessable, and must be greater than 8 characters. 

0 Client is prohibited from modifying server configuration in any way that prevents the server rebooting 
cleanly and/or requiring manual intervention on startup or the application from restarting on 
reboot without manual intervention. 

0 Logicworks has sole authority of server naming for administrative purposes. 

0 If root or Administrator passwords, for Linux and Windows respectively, are changed, the new 
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passwords must be communicated to Logicworks immediately, 

0 No passwords should be sent via email. If passwords are sent via email, they will need to be changed 
immediately. 

0 Client is prohibited from accessing Websites that are likely to contain malicious code from their 
servers, and are generally discouraged from accessing the Internet from their servers. 

B Clients who use centralized configuration deployment (e.g., Puppet, cfengine) must consult with 
Logicworks Senior Engineering before doing so. 

0 Clients may not disable or alter system settings that may affect monitoring, failover, Dr administration 
(e.g., ocarp, syslog, cron, sendmail, snmpd for Linux; syslog agent, snmp service, wmi service, 
windows firewall, remote registry for Windows), 


0 Any changes to network configuration are subject to Senior Engineering approval. 

0 Client SNMP access to devices is limited to read-only access to devices on which client has shared 
administrative access. 

B Administrative access to servers must be available on standard ports and allowed from Logicworks 
administrative networks. 

E All administrative access (SSH, Remote Desktop, FTP, etc.) must be restricted by IP address, or 
accessed via VPN. 

B While Logicworks will communicate to its Internet transit providers any observed upstream peering 
congestion or flapping issues, Logicworks will not be held liable for the performance of 
providers of which it is not a direct customer. 

a All features available in an IDS image feature set (or similar) may not be supported if an alternate 

feature providing the same functionality is available. Changes to currently unsupported features 
are subject to Logicworks Senior Engineering approval. 


Backup and Recovery 

■ Client must specify per-server allocation of committed backup space. 

" Client must maintain adequate space per server to accommodate at least two (2) restore points. 

B Database backups must be written to the local file system first, prior to being copied off-server, 
regardless of whether database backups are being performed by a custom agent. 

0 Logicworks cannot exclude individual files or directories from backups, only partitions. 

0 Logicworks will adjust the number of restore points to conform tD the available space allocated to 
each server, 
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13 All failover scenarios are subject to testing, coordinated by Client and Logicworks within Logicworks 
normal business hours. Testing must be performed post-turnover and prior to going live (i.e„ 
making the Application available to end users). 

0 Web servers and application servers which are dependent on high-availability services need to be 
configured by Client in accordance with Logicworks recommended practices. 

18 Client is responsible for providing the appropriate parameters (e.g., thresholds, failover conditions, 
timeouts, etc. set high enough to not cause false failovers) for high availability configurations. 

■ Clients may not disable or alter system settings that may affect monitoring, failover, or administration 
(e.g., ucarp, syslog, cron, sendmail, snmpd for Linux; syslog agent, snmp service, wmi, database 
mirroring, clustering, log shipping, recurring jobs configured by Logicworks for Windows). Client 
may not alter anything that may affect high availability services without consulting with 
Logicworks Senior Engineering in advance, 


Managed Application Services 

“ Servers for managed application services are single-purpose. 

83 Client is only provided limited access to managed application servers. 

E Clients should only connect to, or have applications connect to, the Virtual IP (VIP) for a managed 
application, not the server's native IP address. 

Managed Database 

" Client is required to maintain a replica (a standby or secondary) server, whose computing power must 
be equal to the computing power of the primary server Dr Group that is not dependent on the 
block device or storage subsystem of the primary database server. 

0 Replica database servers must be used only for reads when not being used as the live database in a 
fail-over scenario. 

f3 If replica database servers are used for reporting, enough resources must remain available for the 
use of the replica server during a fail-over scenario to not be impacted. Client acknowledges 
that additional users of replica server may impact performace during failover use, 

B Client shall be required to provide and maintain, in writing, documentation concerning requested 
failover procedures. 

° Client may be required to maintain separate black devices for log files, data and backups, subject to 
the direction of Logicworks Senior Engineering. 

B Database backups must be written to the local file system first, prior to being copied off-server, 
regardless of whether database backups are being performed by a custom agent. 

E Client must maintain sufficient storage space for 2 local copies of database backups. 

B Client must notify Logicworks if and when it is performing manual database failovers, 

8 Client must notify Logicworks of the creation of additional databases as those additions may affect 
high-availability, backups, or replication (SQL Server only). 



Exhibit F: Technical Policies 


Hourly Billable Services 

s Services that are billable by the hgur must be scheduled in advance. 
e Logicworks is entitled to bill far services to repair servers er applications necessitated by Client's 
actions (not including restores). 

0 Logicworks is entitled to bill for application configuration beyond standard configurations. 

B Logicworks will refer clients to third-parties for services that it does not perform, 

0 Logicworks will not perform hourly services on a monthly recurring basis. 

Hourly billable services are provided as-is and as specified at time of scheduling. Further configuration 
not included in original scope may be subject to additional fees. 



Exhibit G - Microsoft® Addendum 


This document concerns Client's ("you" or "your") use of Microsoft software, which 
includes computer software provided to you by Logicworks Systems Corporation ("Logicworks") 
as described below, and may include associated media, printed materials, and "online" or 
electronic documentation (individually and collectively "Software Products"). Logicworks does 
not own the Software Products and the use thereof is subject to certain rights and limitations of 
which Logicworks needs to inform you. Your right to use the Software Products is subject to 
your agreement with Logicworks, and to your understanding of, compliance with and consent to 
the following terms and conditions, which Logicworks does not have authority to vary, alter or 
amend. 


1. DEFINITIONS. 

(a) "Client Software" means software that allows a Device to access or utilize 
the services or functionality provided by the Server Software. 

(b) "Device" means each of a computer, workstation, terminal, handheld PC, 
pager, telephone, personal digital assistant, "smart phone, 1 or other electronic device. 

(c) "Server Software" means software that provides services or functionality 
on a computer acting as a aerver. 

2. OWNERSHIP OF SOFTWARE PRODUCTS. The Software Products are licensed to 
Logicworks from an affiliate of Microsoft Corporation ("Microsoft"). All title and intellectual 
property rights in and to the Software Products (and the constituent elements thereof, including 
but not limited to any images, photographs, animations, video, audio, music, text and "applets" 
incorporated into the Software Products) are owned by Microsoft or its suppliers. The Software 
Products are protected by copyright laws and international copyright treaties, as well as other 
intellectual property laws and treaties. Your possession, access, or use of the Software Products 
does not transfer any ownership of the Software Products or any intellectual property rights to 
you 

3. USE OF CLIENT SOFTWARE. You may use the Client Software installed on your 
Devices by Logicworks only in accordance with the instructions, and only in connection with the 
services, provided to you by Logicworks. The terms of this document permanently and 
irrevocably supersede the terms of any Microsoft End User License Agreement which may be 
presented in electronic form during your use of the Client Software. 

4. USE OF REDISTRIBUTION SOFTWARE, In connection with the services provided 
to you by Logicworks, you may have access to certain "sample," "redistributable" and/or 
software development ("SDK") software code and tools (individually and collectively 

"Redistribution Software"). YOU MAY NOT USE, MODIFY, COPY, AND/OR DISTRIBUTE ANY 
REDISTRIBUTION SOFTWARE UNLESS YOU EXPRESSLY AGREE TO AND COMPLY WITH CERTAIN 
ADDITIONAL TERMS CONTAINED IN THE SERVICES PROVIDER USE RIGHTS ("SPUR") 
APPLICABLE TO LOGICWORKS, WHICH TERMS MUST BE PROVIDED TO YOU BY LOGICWORKS. 
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Exhibit G - Microsoft® Addendum 


Microsoft does not permit you to use any Redistribution Software unless you expressly agree to 
and comply with such additional terms, as provided to you by Logicworks. 

5. COPIES, You may not make any copies of the Software Products; provided, 
however, that you may make one (1) copy of Client Software on your Device as expressly 
authorized by Logicworks. 

6. LIMITATIONS ON REVERSE ENGINEERING, DECOMPILATION AND DISASSEMBLY. 
You may not reverse engineer, decompile, or disassemble the Software Products, except and 
only to the extent that applicable law, notwithstanding this limitation expressly permits such 
activity. 

7. NO RENTAL. You may not rent, lease, lend, pledge, or directly or indirectly 
transfer or distribute the Software Products to any third party, and you may not permit any third 
party to have access to and/or use the functionality of the Software Products. 

8. TERMINATION. Without prejudice to any other rights, Logicworks may terminate 
your rights to use the Software Products if you fail to comply with these terms and conditions. 

In the event of termination or cancellation, you must stop using and/or accessing the Software 
Products, and destroy all copies of the Software Products and all of its component parts. 

9. NO WARRANTIES, LIABILITIES OR REMEDIES BY MICROSOFT. ANY WARRANTIES, 
LIABILITY FOR DAMAGES AND REMEDIES, IF ANY, ARE PROVIDED SOLELY BY LOGICWORKS 
AND NOT BY MICROSOFT OR ITS AFFILIATES OR SUBSIDIARIES. 

10. PRODUCT SUPPORT. Any product support for the Software Products is provided 
to you by Logicworks and is not provided by Microsoft or its affiliates or subsidiaries. 

11. NOT FAULT TOLERANT. THE SOFTWARE PRODUCTS MAY CONTAIN TECHNOLOGY 
THAT IS NOT FAULT TOLERANT AND IS NOT DESIGNED, MANUFACTURED, OR INTENDED FOR 
USE IN ENVIRONMENTS OR APPLICATIONS IN WHICH THE FAILURE OF THE SOFTWARE 
PRODUCTS COULD LEAD TO DEATH, PERSONAL INJURY, OR SEVERE PHYSICAL, PROPERTY OR 
ENVIRONMENTAL DAMAGE. 

12. EXPORT RESTRICTIONS. The Software Products are of U.S. origin for purposes of 
U.S. export control laws. You agree to comply with all applicable international and national laws 
that apply to the Software Products, including the U.S. Export Administration Regulations, as 
well as end-user, end-use and destination restrictions issued by U.S. and other governments. For 
additional information, see http://www.microsoft.com/exporting/ . 

13. LIABILITY FOR BREACH. In addition to any liability you may have to Logicworks, 
you agree that you will also be legally responsible directly to Microsoft for any breach of these 
terms and conditions. 
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Delivery ASAP - Dev / UAT Environment_ 


* Managed Virtual Machines (Red Hat Enterprise Linux) $ 95.00 $ 

Managed virtual servers include VMware ESX and Red Hat Enterprise Linux. Servers are imaged with 
monitoring, backup, and management tools included. Red Hat Virtual Servers run on dedicated 
VMware ESX physical hosts including full redundancy and fail-over capabilities: VMotion, VSphere, and 
Storage VMotion. 

Managed Virtual Machines (Red Hat Enterprise Linux) $ 95.00 $ 

Managed virtual servers include VMware ESX and Red Hat Enterprise Linux. Servers are imaged with 
monitoring, backup, and management tools included. Red Hat Virtual Servers run on dedicated 
VMware ESX physical hosts including full redundancy and fail-over capabilities: VMotion, VSphere, and 
Storage VMotion. 

* Managed Virtual Machines (Windows 2008 Enterprise) $ 120.00 $ 

Managed virtual servers include VMware ESX and Windows 2008 Enterprise. Servers are imaged with 
monitoring, backup, and management tools included. Red Hat Virtual Servers run on dedicated 
VMware ESX physical hosts including full redundancy and fail-over capabilities: VMotion, VSphere, and 
Storage VMotion. 

* ESX Host Servers $ 1,207.00 $ 

CPU: 2 x 5660 Hex-Core 

RAM: 96GB 
Disk; 2 x 146GB SAS 

Private Cloud hosts power all virtual machines, guaranteeing a high-performance and highly reliable 
VMware environment. Hosts run Intel Westmere processors, include redundant boot/OS drives, and 
connect to enterprise storage for their VMFS VMware File System Data, and include redundant 
connections to switches. In the event of a host failure, all tasks are automatically routed to an 
alternate host. 

VNX 5500 Unified Storage System $ 32,400.00 $ 

Disk: 34 x 600GB 15K SAS (RAID 10) - Oracle RAC Storage 
Disk: 34 x 900GB 10K SAS (RAID 6) - VMFS Storage 
Disk: 26 x 3TB 7.2K SAS (RAID 6) - Archival Storage 
Disk: 11 x 100GB SSD - FastCache 

The EMC VNX 5500 Unified Storage System provides SAN storage for Oracle RAC Database as well as 
NAS storage for VMware File Systems. The VNX device is scalable to 250 disks and includes redundant 
power supply, RAID controllers, and high-availability disk sets, and a FastCache SSD-based caching 
volume. 


1,900.00 


1,805.00 


7,242.00 


32,400.00 


* Managed Security $ 851.00 $ 

Cisco ASA 5515X Firewalls 

Redundant Cisco ASA 5520 Firewalls for the production site, and an additional ASA 5520 for the 
Disaster Recovery site are managed by Logicworks to provide firewall security and de-militarized zone 
separation. Confidential data will be segregated onto an isolated VLAN from any devices that face the 
Internet. 


1,702.00 



4 


7,100.00 


* Extreme Networks Switches $ 1,775.00 $ 

Dedicated 48-port Extreme 460 Stackable switch network ensures 10Gb Gigabit routing to Logicworks' 
core and to the EMC VNX Storage device and Gb connections to each device. 


1 Intrusion Detection System $ 1,750.00 $ 1,750.00 

Alert Logic ThreatManager 1460 with Active Watch 

Alert Logic Threat Manager with Active Watch monitors ail attempts to connect to servers and devices 
within the hosted environment. Suspicious and malicious attempts to access the system are flagged, 
given a threshold of severity, and escalated to Logicworks' security operations team. 

1 Log Manager (250 Nodes) $ 4,236.00 $ 

Alert Logic Log Management collects, inspects, and archives all log data across devices including 
switches, firewalls, hosts, and virtual machines. Custom reporting is available for HIPAA and PCI 
standards including administrator rights, data integrity, and access logs. 250 nodes, 12 month 
retention. 

20 Two-Factor Authentication $ 44.00 $ 

Vasco Two-Factor Authentication System provides each server administrator with a smart phone - 
accessible unique identifier. This second means of authentication ensures that a stolen username / 
passwords cannot be used to gain access to the hosted infrastructure, (per administrator) 

2 * Load-Balancers-Traffic Manager (Full) $ 2,276.00 $ 4,552.00 

Redundant RiverBed Stingray load-balancers offer both IP- and Application- based load-balancing and 
traffic management. Redundant devices in production and a single device in DR include 500Mb 
throughput licensing (upgradable to 1Gb). Includes traffic management and SSL Off-Loading 

50 * Bandwidth $ 24.00 $ 1,200.00 

95% Outbound bandwidth per month in Mbps 
(Overage available on a /Mbps basis at $30/Mbps) 

10,000 Backups & Recovery $ 0.60 $ 6,000.00 

Data is replicated nightly across Logicworks' datacenters and across state lines to high-availability disk. 

On-demand restores are included in the service, (in GB) 

0 Professional Services Hourly Rate $ 250.00 $ 

1 * Managed Services included $ 

24 x 7 x 365 Engineering support, managed security, dedicated account manager, backups, custom 

1 Oracle Database Services included $ 

Clustering & replication support for Oracle Databases, 100% SLA for Oracle DB, senior engineering for 

Sub-Total $_ 71,007.00 

_ * indicates priority items _ 

_ Delivery ASAP Perf Environment _ 

32 Managed Virtual Machines (Red Hat Enterprise Linux) 

8 ESX Host Servers 

CPU: 2 x 5660 Hex-Core 
RAM: 96GB 
Disk: 2 x 146GB SAS 


$ 95.00 $ 3,040.00 

$ 1,207.00 $ 9,656.00 


4,236.00 


880.00 






4 

App / Database Servers 

CPU: 2 x 5660 Hex-Core 

RAM: 48GB 

Disk: 2 x 146GB SAS 

Fibre-Channel HBA 

Sub-Total 

$ 

$ 

1,574.00 $ 

18,992.00 

6,296.00 

Delivery February 18, 2013 Training Environment 

8 

Managed Virtual Machines (Red Hat Enterprise Linux) 

$ 

105.00 $ 

840.00 

2 

ESX Host Servers 

$ 

1,330.00 $ 

2,660.00 


CPU: 2 x 5660 Hex-Core 





RAM: 96GB 





Disk: 2 x146GB SAS 





Sub-Total 

$ 

3,500.00 



Delivery June 15th 2013 - Production & Disaster Recovery Environments 


62 

Managed Virtual Machines (Red Hat Enterprise Linux) 

$ 

105.00 

$ 

6,510.00 

0 

Managed Virtual Machines (Windows 2008 Enterprise) 

$ 

135.00 

$ 

- 

8 

ESX Host Servers 

CPU: 2 x 5660 Hex-Core 

RAM: 96GB 

Disk: 2 x 146GB SAS 

$ 

1,330.00 

s 

10,640.00 

4 

App / Database Servers 

CPU: 2 x 5660 Hex-Core 

RAM: 48GB 

Disk: 2 x 146GB SAS 

Fibre-Channel HBA 

$ 

1,702.00 

s 

6,808.00 

2 

Database Servers (DR) 

CPU: 2 x 5660 Hex-Core (24-bay) 

RAM: 48GB 

Disk: 2 x 146GB SAS (System) 

Disk:12x 300GB SAS (Data) 

Disk:4 x 1TB SATA (Backups) 

$ 

2,715.00 

$ 

5,430.00 

3,800 

NAS Storage (For DR Virtual Servers) 

Scalable EMC Isilon Storage 

$ 

1.00 

s 

3,800.00 


The DR environment will store VMware File System on Logicworks' enterprise NAS storage system, 



2 

HP Switches (DR) 

$ 

506.00 

s 

1,012.00 


Hewlett Packard Gb Ethernet switches provide connectivity for the disaster recovery environment. 



1 

Managed Security (DR) 

$ 

936.00 

$ 

936.00 

1 

Intrusion Detection System (DR) 

$ 

1,925.00 

$ 

1,925.00 

1 

Load-Balancer (DR) 

$ 

2,505.00 

s 

2,505.00 


Sub-Total 

$ 

39,566.00 




Total Monthly Recurring - Term through September 30th, 2014 $ 133,065.00 











The Master Service Agreement between Client and Logicworks (the "MSA"), and Logicworks' Acceptable 
Use Policy, Tech Policies and Responsibility Matrix, as they each may be amended from time to time 
pursuant to the MSA, are incorporated by reference in this Service Order. Capitalized terms not defined in 
this Service Order have the meaning given them in the MSA, Acceptable Use Policy, Responsibility Matrix 
or Tech Policies. | 

The person signing below represents that he or she is authorized to sign this Service Order on behalf of 
Client and that Client accepts this Service Order subject to the terms in the MSA, Acceptable Use Policy, 
Responsibility Matrix and Tech Policies. 


CGI Technologies and Solutions, Inc. 


Approval Signature: 


Name/Title: 


Date: 










CGI Technologies and Solutions, Inc. 


iogkworks f ffy; 


Date: Wednesday, December 19, 2012 

Quote#: 1041262 


Account Exec: 
Expires: 


Steve Zeller 

Monday December 31, 2012 


MONTHLY RECURRING Service Order 

Qty 


Description 


Unit Price 


Monthly Recurring 


MASSACHUSETTS HIX Hosting Environment 


Delivery ASAP - Dev / UAT Environment _ 


* Managed Virtual Machines (Red Hat Enterprise Linux) $ 95.00 $ 

Managed virtual servers include VMware ESX and Red Hat Enterprise Linux. Servers are imaged with 
monitoring, backup, and management tools included. Red Hat Virtual Servers run on dedicated 
VMware ESX physical hosts including full redundancy and fail-over capabilities: VMotion, VSphere, and 
Storage VMotion. 

Managed Virtual Machines (Red Hat Enterprise Linux) $ 95.00 $ 

Managed virtual servers include VMware ESX and Red Hat Enterprise Linux. Servers are imaged with 
monitoring, backup, and management tools included. Red Hat Virtual Servers run on dedicated 
VMware ESX physical hosts including full redundancy and fail-over capabilities: VMotion, VSphere, and 
Storage VMotion. 

* Managed Virtual Machines (Windows 2008 Enterprise) $ 120.00 $ 

Managed virtual servers include VMware ESX and Windows 2008 Enterprise. Servers are imaged with 
monitoring, backup, and management tools included. Red Hat Virtual Servers run on dedicated 
VMware ESX physical hosts including full redundancy and fail-over capabilities: VMotion, VSphere, and 
Storage VMotion. 

* ESX Host Servers $ 1,207.00 $ 

CPU: 2 x 5660 Hex-Core 

RAM: 96GB 
Disk: 2 x 146GB SAS 

Private Cloud hosts power all virtual machines, guaranteeing a high-performance and highly reliable 
VMware environment. Hosts run Intel Westmere processors, include redundant boot/OS drives, and 
connect to enterprise storage for their VMFS VMware File System Data, and include redundant 
connections to switches. In the event of a host failure, all tasks are automatically routed to an 
alternate host. 

VNX 5500 Unified Storage System $ 32,400.00 $ 

Disk: 34 x 600GB 10K SAS (RAID 10) - Oracle RAC Storage 
Disk: 34 x 900GB 10K SAS (RAID 6) - VMFS Storage 
Disk: 26 x 3TB 7.2K SAS (RAID 6) - Archival Storage 
Disk: 11 x 100GB SSD - FastCache 

The EMC VNX 5500 Unified Storage System provides SAN storage for Oracle RAC Database as well as 
NAS storage for VMware File Systems. The VNX device is scalable to 250 disks and includes redundant 
power supply, RAID controllers, and high-availability disk sets, and a FastCache SSD-based caching 
volume. 


1,900.00 


1,805.00 


7,242.00 


32,400.00 


* Managed Security $ 851.00 $ 

Cisco ASA 5520 Firewalls 

Redundant Cisco ASA 5520 Firewalls for the production site, and an additional ASA 5520 for the 
Disaster Recovery site are managed by Logicworks to provide firewall security and de-militarized zone 
separation. Confidential data will be segregated onto an isolated VLAN from any devices that face the 
Internet. 


1,702.00 




4 


7,100.00 


* Extreme Networks Switches $ 1,775.00 $ 

Dedicated 48-port Extreme 460 Stackable switch network ensures 10Gb Gigabit routing to Logicworks' 
core and to the EMC VNX Storage device and Gb connections to each device. 


1 Intrusion Detection System $ 1,750.00 $ 1,750.00 

Alert Logic ThreatManager 1460 with Active Watch 

Alert Logic Threat Manager with Active Watch monitors all attempts to connect to servers and devices 
within the hosted environment. Suspicious and malicious attempts to access the system are flagged, 
given a threshold of severity, and escalated to Logicworks' security operations team. 

1 Log Manager (250 Nodes) $ 4,236.00 $ 4,236.00 

Alert Logic Log Management collects, inspects, and archives all log data across devices including 
switches, firewalls, hosts, and virtual machines. Custom reporting is available for HIPAA and PCI 
standards including administrator rights, data integrity, and access logs. 250 nodes, 12 month 
retention. 

20 Two-Factor Authentication $ 44.00 $ 880.00 

Vasco Two-Factor Authentication System provides each server administrator with a smart phone - 
accessible unique identifier. This second means of authentication ensures that a stolen username / 
passwords cannot be used to gain access to the hosted infrastructure, (per administrator) 

2 * Load-Balancers-Traffic Manager (Full) $ 2,276.00 $ 4,552.00 

Redundant RiverBed Stingray load-balancers offer both IP- and Application- based load-balancing and 
traffic management. Redundant devices in production and a single device in DR include 500Mb 
throughput licensing (upgradable to 1Gb). Includes traffic management and SSL Off-Loading 

50 * Bandwidth $ 24.00 $ 1,200.00 

95% Outbound bandwidth per month in Mbps 
(Overage available on a /Mbps basis at $30/Mbps) 

10,000 Backups & Recovery $ 0.60 $ 6,000.00 

Data is replicated nightly across Logicworks' datacenters and across state lines to high-availability disk. 

On-demand restores are included in the service, (in GB) 

0 Professional Services Hourly Rate $ 250.00 $ 

1 * Managed Services included $ 

24 x 7 x 365 Engineering support, managed security, dedicated account manager, backups, custom 

1 Oracle Database Services included $ 

Clustering & replication support for Oracle Databases, 100% SLA for Oracle DB, senior engineering for 

Sub-Total $_ 71,007,00 

_* indicates priority items_ 


Delivery ASAP Perf Environment 


32 Managed Virtual Machines (Red Hat Enterprise Linux) 

$ 

95.00 

$ 

3,040.00 

8 ESX Host Servers 

$ 

1,207.00 

$ 

9,656.00 

CPU: 2 x 5660 Hex-Core 

RAM: 96GB 

Disk: 2 x 146GB SAS 










$ 


1,574.00 $ 


6,296.00 


4 App / Database Servers 

CPU: 2 x 5660 Hex-Core 
RAM: 48GB 
Disk: 2 x 146GB SAS 
Fibre-Channel HBA 


Sub-Total 

$ 

18,992.00 


Delivery February 1, 2013 Training Environment 




8 Managed Virtual Machines (Red Hat Enterprise Linux) 

$ 

105.00 $ 

840.00 

2 ESX Host Servers 

CPU: 2 x 5660 Hex-Core 

RAM: 96GB 

Disk: 2 x146GB SAS 

$ 

1,330.00 $ 

2,660.00 

Sub-Total 

$ 

3,500.00 



Delivery June 15th 2013 - Production & Disaster Recovery Environments 


62 

Managed Virtual Machines (Red Hat Enterprise Linux) 

$ 

105.00 $ 

6,510.00 

0 

Managed Virtual Machines (Windows 2008 Enterprise) 

$ 

135.00 $ 

- 

8 

ESX Host Servers 

CPU: 2 x 5660 Hex-Core 

RAM: 96GB 

Disk: 2 x 146GB SAS 

s 

1,330.00 $ 

10,640.00 

4 

App / Database Servers 

CPU: 2 x 5660 Hex-Core 

RAM: 48GB 

Disk: 2 x 146GB SAS 

Fibre-Channel HBA 

$ 

1,702.00 $ 

6,808.00 

2 

Database Servers (DR) 

CPU: 2 x 5660 Hex-Core (24-bay) 

RAM: 48GB 

Disk: 2 x 146GB SAS (System) 

Disk:12x 300GB SAS (Data) 

Disk:4 x 1TB SATA (Backups) 

s 

2,715.00 $ 

5,430.00 

3,800 

NAS Storage (For DR Virtual Servers) 

Scalable EMC Isilon Storage 

$ 

1.00 $ 

3,800.00 


The DR environment will store VMware File System on Logicworks' enterprise NAS storage system, 


2 

HP Switches (DR) 

$ 

506.00 $ 

1,012.00 


Hewlett Packard Gb Ethernet switches provide connectivity for the disaster recovery environment. 


1 

Managed Security (DR) 

$ 

936.00 $ 

936.00 

1 

Intrusion Detection System (DR) 

$ 

1,925.00 $ 

1,925.00 

1 

Load-Balancer (DR) 

$ 

2,505.00 $ 

2,505.00 


Sub-Total 

$ 

39,566.00 



Total Monthly Recurring - Term through September 30th, 2014 


$ 


133,065.00 









The Master Service Agreement between Client and Logicworks (the "MSA"), and Logicworks' Acceptable 
Use Policy, Tech Policies and Responsibility Matrix, as they each may be amended from time to time 
pursuant to the MSA, are incorporated by reference in this Service Order. Capitalized terms not defined in 
this Service Order have the meaning given them in the MSA, Acceptable Use Policy, Responsibility Matrix 
or Tech Policies. 

The person signing below represents that he or she is authorized to sign this Service Order on behalf of 
Client and that Client accepts this Service Order subject to the terms in the MSA, Acceptable Use Policy, 
Responsibility Matrix and Tech Policies. 


CGI Technologies and Solutions, Inc. 


Approval Signature: 


Name/Title: 











ogicworks 



CGI Technologies and Solutions, Inc. 


Date: Tuesday, December 18, 2012 

Quote#: 1041261 

One-Time (non-recurring) Service Order 

Account Exec: 
Expires: 

Steve Zeller 

Monday December 31, 2012 

Qty 

Description 


Unit Price 


Setup Cost 

1 

Dev Environment Setup / Installation Cost 

$ 

56,382.00 

$ 

56,382.00 

1 

Perf Environment Setup / Installation Cost 

$ 

14,336.00 

$ 

14,336.00 

1 

Training Environment Setup / Installation Cost 

$ 

3,547.00 

$ 

3,547.00 

1 

Prod / DR Environment Setup / Installation Cost 

$ 

26,575.00 

$ 

26,575.00 


Total One-Time Cost 



$ 

100,840.00 


CGI Technologies and Solutions, Inc. 
Approval Signature: _ 


Name/Title: 


Date: 





Exhibit h 


RFR 



ACCESSING the HIX RFR Documents on COMMBUYS.com 

THE RFR for HIX is located on COMMBUYS. Please go to www.commbuvs.com to begin your search. 

1. Click on: 

'_3 Contract & Bid Search 

Search for Bids and active Contracts/Blankets. 

2. Click the Bids button: 



3. In the Bid# Block, type in S127635: 


Bid# SI 27635 

4. Click Find It: 



In the Results block below the Find It button, the RFR should appear: 


Ign 

Bid# 

Contract/Blanket # 

Buyer Description 

S127SM-vCurrent 


eProcurement SoBcitatjon RFR for Massachusetts Health Insurance exchange and Integrated EUglTly System MA HOC/IES: System 


5. Click on the highlighted link S127635 to access the RFR and all of its associated documents: 

S1Z7835-¥Current 




Attachment 2 


Section 11 Clarification 


Pursuant to Section 11. Indemnification of the Commonwealth Terms and Conditions, the term “other 
damages” shall include, but shall not be limited to, the reasonable costs the Commonwealth incurs to repair, 
return, replace or seek cover (purchase of comparable substitute commodities and services) under a contract. 
“Other damages” shall not include damages to the Commonwealth as a result of third party claims, provided, 
however, that the foregoing in no way limits the Commonwealth’s right of recovery for personal injury or 
property damages or patent and copyright infringement under Section 11 nor the Commonwealth’s ability to 
join the contractor as a third party defendant. Further, the term “other damages” shall not include, and in no 
event shall the contractor be liable for, damages for the Commonwealth’s use of contractor provided 
products or services, loss of Commonwealth records, or data (or other intangible property), loss of use of 
equipment, lost revenue, lost savings or lost profits of the Commonwealth. In no event shall “other damages” 
exceed the greater of $100,000, or two times the value of the product or service (as defined in the contract 
scope of work) that is the subject of the claim. Section 11 sets forth the contractor’s entire liability under a 
contract. Nothing in this section shall limit the Commonwealth’s ability to negotiate higher limitations of 
liability in a particular contract, provided that any such limitation must specifically reference Section 11 of 
the Commonwealth Terms and Conditions. 
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Attachment 3 


Commonwealth Terms and Conditions 



Page 7. of 2. 

Sensitivity level - high (when filled in) low (when blank) 






COMMONWEALTH TERMS AND CONDITIONS 


This Commonwealth Terms and Conditions form is 
jointly issued by the Executive Office for 
Administration and Finance (ANF), the Office of the 
Comptroller (CTR) and the Operational Services 
Division (OSD) for use by all Commonwealth of Massachusetts (“State”) 
Departments and Contractors. Any changes or electronic alterations by either 
the Department or the Contractor to the official version of this form, as 
jointly published by ANF, CTR and OSD, shall be void. Upon execution of 
these Commonwealth Terms and Conditions by the Contractor and filing as 
prescribed by the Office of the Comptroller, these Commonwealth Terms and 
Conditions will be incorporated by reference into any Contract for 
Commodities and Services executed by the Contractor and any State 
Department, in the absence of a superseding law or regulation requiring a 
different Contract form. Performance shall include services rendered, 
obligations due, costs incurred, commodities and deliverables provided and 
accepted by the Department, programs provided or other commitments 
authorized under a Contract. A deliverable shall include any tangible product 
to be delivered as an element of performance under a Contract. The 
Commonwealth is entitled to ownership and possession of all deliverables 
purchased or developed with State funds. Contract shall mean the Standard 
Contract Form issued jointly by ANF, CTR and OSD. 

1. Contract Effective Start Date, Notwithstanding verbal or other 
representations by the parties, or an earlier start date indicated in a Contract, 
the effective start date of performance under a Contract shall be the date a 
Contract has been executed by an authorized signatory of the Contractor, the 
Department, a later date specified in the Contract or the date of any approvals 
required by law or regulation, whichever is later, 

2. Payments And Compensation. The Contractor shall only be compensated 
for performance delivered and accepted by the Department in accordance with 
the specific tenns and conditions of a Contract. All Contract payments are 
subject to appropriation pursuant to M.O.L. C. 29, §26, or the availability of 
sufficient non-appropriated funds for the purposes of a Contract, and shall be 
subject to intercept pursuant to M.G.L. C. 7A, §3 and 815 CMR 9.00. 
Overpayments shall be reimbursed by the Contractor or may be offset by the 
Department from future payments in accordance with state finance law. 
Acceptance by the Contractor of any payment or partial payment, without any 
written objection by the Contractor, shall in each instance operate as a release 
and discharge of the State from all claims, liabilities or other obligations 
relating to the performance of a Contract. 

3. Contractor Payment Mechanism. All Contractors will be paid using the 
Payment Voucher System unless a different payment mechanism is required. 
The Contractor shall timely submit invoices (Payment Vouchers - Form PV) 
and supporting documentation as prescribed in a Contract. The Department 
shall review and return rejected invoices within fifteen (15) days of receipt with 
a written explanation for rejection. Payments shall be made in accordance with 
the bill paying policy issued by the Office of the Comptroller and 815 CMR 
4.00, provided that payment periods listed in a Contract of less than forty-five 
(45) days from the date of receipt of an invoice shall be effective only to enable 
a Department to take advantage of early payment incentives and shall not 
subject any payment made within the forty-five (45) day period to a penalty. 
The Contractor Payroll System, shall be used only for "Individual Contractors" 
who have been determined to be "Contract Employees" as a result of the 
Department's completion of an Internal Revenue Service SS-8 form in 
accordance with the Omnibus Budget Reconciliation Act (OBRA) 1990, and 
shall automatically process all state and federal mandated payroll, tax and 
retirement deductions. 

4. Contract Termination Or Suspension. A Contract shall terminate on the 
date specified in a Contract, unless this date is properly amended in accordance 
with all applicable laws and regulations prior to this date, or unless terminated 
or suspended under this Section upon prior written notice to the Contractor. 
The Department may terminate a Contract without cause and without penalty, 
or may terminate or suspend a Contract if the Contractor breaches any material 
term or condition or fails to perform or fulfill any material obligation required 
by a Contract, or in the event of an elimination of an appropriation or 
availability of sufficient funds for the purposes of a Contract, or in the event of 
an unforeseen public emergency mandating immediate Department action. 
Upon immediate notification to the other party, neither the Department nor the 
Contractor shall be deemed to be in breach for failure or delay in performance 
due to Acts of God or other causes factually beyond their control and without 
their fault or negligence. Subcontractor failure to perform or price increases 


due to market fluctuations or product availability will not be deemed factually 
beyond the Contractor's control. 

5. Written Notice . Any notice shall be deemed delivered and received when 
submitted in writing in person or when delivered by any other appropriate 
method evidencing actual receipt by the Department or the Contractor. Any 
written notice of termination or suspension delivered to the Contractor shall 
state the effective date and period of the notice, the reasons for the termination 
or suspension, if applicable, any alleged breach or failure to perform, a 
reasonable period to cure any alleged breach or failure to perform, if 
applicable, and any instructions or restrictions concerning allowable activities, 
costs or expenditures by the Contractor during the notice period. 

6. Confidentiality . The Contractor shall comply with M.G.L. C. 66A if the 
Contractor becomes a "holder" of "personal data". The Contractor shall also 
protect the physical security and restrict any access to personal or other 
Department data in the Contractor's possession, or used by the Contractor in the 
performance of a Contract, which shall include, but is not limited to the 
Department's public records, documents, files, software, equipment or systems. 

7. Record-keeping And Retention. Inspection Of Records. The Contractor 
shall maintain records, books, files and other data as specified in a Contract and 
in such detail as shall properly substantiate claims for payment under a 
Contract, for a minimum retention period of seven (7) years beginning on the 
first day after the final payment under a Contract, or such longer period as is 
necessary for the resolution of any litigation, claim, negotiation, audit or other 
inquiry involving a Contract. The Department shall have access, as well as any 
parties identified under Executive Order 195, during-the Contractor’s regular 
business hours and upon reasonable prior notice, to such records, including on¬ 
site reviews and reproduction of such records at a reasonable expense. 

8. Assignment. The Contractor may not assign or delegate, in whole or in 
part, or otherwise transfer any liability, responsibility, obligation, duty or 
interest under a Contract, with the exception that the Contractor shall be 
authorized to assign present and prospective claims for money due to the 
Contractor pursuant to a Contract in accordance with M.G.L, C. 106, §9-318. 
The Contractor must provide sufficient notice of assignment and supporting 
documentation to enable the Department to verify and implement the 
assignment. Payments to third party assignees will be processed as if such 
payments were being made directly to the Contractor and these payments will 
be subject to intercept, offset, counter claims or any other Department rights 
which are available to the Department or the State against the Contractor. 

9. Subcontracting By Contractor. Any subcontract entered into by the 
Contractor for the purposes of fulfilling the obligations under a Contract must 
be in writing, authorized in advance by the Department and shall be consistent 
with and subject to the provisions of these Commonwealth Terms and 
Conditions and a Contract. Subcontracts will not relieve or discharge the 
Contractor from any duty, obligation, responsibility or liability arising under a 
Contract. The Department is entitled to copies of all subcontracts and shall not 
be bound by any provisions contained in a subcontract to which it is not a 
party. 

10. Affirmative Action. Non-Discrimination In Hiring And Employment. 
The Contractor shall comply with all federal and state laws, rules and 
regulations promoting fair employment practices or prohibiting employment 
discrimination and unfair labor practices and shall not discriminate in the hiring 
of any applicant for employment nor shall any qualified employee be demoted, 
discharged or otherwise subject to discrimination in the tenure, position, 
promotional opportunities, wages, benefits or terms and conditions of their 
employment because of race, color, national origin, ancestry, age, sex, religion, 
disability, handicap, sexual orientation or for exercising any rights afforded by 
law. The Contractor commits to' purchasing supplies and services from 
certified minority or women-owned businesses, small businesses or businesses 
owned by socially or economically disadvantaged persons or persons with 
disabilities. 

11. Indemnification. Unless otherwise exempted by law, the Contractor shall 
indemnify and hold harmless the State, including the Department, its agents, 
officers and employees against any and all claims, liabilities and costs for any 
personal injury or property damages, patent or copyright infringement or other 
damages that the State may sustain which arise out of or in connection with the 
Contractor's performance of a Contract, including but not limited to the 
negligence, reckless or intentional conduct of the Contractor, its agents, 
officers, employees or subcontractors. The Contractor shall at no time be 
considered an agent or representative of the Department or the State. After 
prompt notification of a claim by the State, the Contractor shall have an 
opportunity to participate in the defense of such claim and any negotiated 
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settlement agreement or judgment. The State shall not be liable for any costs 
incurred by the Contractor arising under this paragraph. Any indemnification of 
the Contractor shall be subject to appropriation and applicable law. 

12. Waivers. Forbearance or indulgence in any form or manner by a party shall 
not be construed as a waiver, nor in any way limit the legal or equitable 
remedies available to that party. No waiver by either party of any default or 
breach shall constitute a waiver of any subsequent default or breach. 

13. Risk Of Loss. The Contractor shall bear the risk of loss for any Contractor 
materials used for a Contract and for all deliverables, Department personal or 
other data which is in the possession of the Contractor or used by the 
Contractor in the performance of a Contract until possession, ownership and 
full legal title to the deliverables are transferred to and accepted by the 
Department. 

14. Forum. Choice of Law And Mediation. Any actions arising out of a 
Contract shall be governed by the laws of Massachusetts, and shall be brought 
and maintained in a State or federal court in Massachusetts which shall have 
exclusive jurisdiction thereof. The Department, with the approval of the 
Attorney General's Office, and the Contractor may agree to voluntary 
mediation through the Massachusetts Office of Dispute Resolution (MODR) of 
any Contract dispute and will share the costs of. such mediation. No legal or 
equitable rights of the parties shall be limited by this Section. 

15. Contract Boilerplate Interpretation. Severability. Conflicts With Law. 
Integration. Any amendment or attachment to any Contract which contains 
conflicting language or has the affect of a deleting, replacing or modifying any 
printed language of these Commonwealth Terms and Conditions, as officially 
published by ANF, CTR and OSD, shall be inteipreted as superseded by the 

CONTRACTOR AUTHORIZED SIGNATORY: 


official printed language. If any provision of a Contract is found to be 
superseded by state or federal law or regulation, in whole or in part, then both 
parties shall be relieved of all obligations under that provision only to the 
extent necessary to comply with the superseding law, provided however, that 
the remaining provisions of the Contract, or portions thereof, shall be enforced 
to the fullest extent permitted by law. All amendments must be executed by 
the parties in accordance with Section 1. of these Commonwealth Terms and 
Conditions and filed with the original record copy of a Contract as prescribed 
by CTR. The printed language of the Standard Contract Form, as officially 
published by ANF, CTR and OSD, which incorporates by reference these 
Commonwealth Terms and Conditions, shall supersede any conflicting verbal 
or written agreements relating to the performance of a Contract, or attached 
thereto, including contract forms, purchase orders or invoices of the Contractor. 
The order of priority of documents to interpret a Contract shall be as follows: 
the printed language of the Commonwealth Terms and Conditions, the 
Standard Contract Fonn, the Department's Request for Response (RFR) 
solicitation document and the Contractor’s Response to the RFR solicitation, 
excluding any language stricken by a Department as unacceptable and 
including any negotiated terms and conditions allowable pursuant to law or 
regulation. 

IN WITNESS WHEREOF, The Contractor certify under the pains and 
penalties of perjury that it shall comply with these Commonwealth Terms 
and Conditions for any applicable Contract executed with the 
^ommqriyl'eal.tiQs certified by their authorized signatory below: 


Print Name: 


" ’ Paul 




I o 


Title: 


Date: 


Ace ftei/c(g <hScLs y S^t/f c 

& I % j Q 0 1 _ 



(Check One): X _ Organization 

Full Legal Organization or Individual Name: 


Individual 


Loj t U'caf 


b S'' 




Corf 


k 


wcCVJt/l 


Doing Business As: Name (If Different): 


Tax Identification Number: 
Address: I rf 



t/\ sf 1 c O.S S 


T'h 


£l#or 


Telephone: 


2: Lk 




o 


FAX: 


c zs 


INSTRUCTIONS FOR FILING THE COMMONWEALTH TERMS AND CONDITIONS 

A “Request for Verification of Taxation Reporting Information” form (Massachusetts Substitute W-9 Format), that contains the Contractor's 
correct TIN, name and legal address information, must be on file with the Office of the Comptroller. If the Contractor has not previously 
filed this form with the Comptroller, or if the information contained on a previously filed form has changed, please fill out a W-9 form and 
return it attached to the executed COMMONWEALTH TERMS AND CONDITIONS. 

If the Contractor is responding to a Request for Response (RFR), the COMMONWEALTH TERMS AND CONDITIONS must be submitted 
with the Response to RFR or as specified in the RFR. Otherwise, Departments or Contractors must timely submit the completed and 
properly executed COMMONWEALTH TERMS AND CONDITIONS (and the W-9 form if applicable) to the; Payee and Payments Unit, 
Office of the Comptroller, 9th Floor, One Ashburton Place, Boston, MA 02108 in order to record the filing of this form on the MMARS 
Vendor File. Contractors are required to execute and file this form only once 
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Thl t s k fo f. is issu ® d and P uM3hed by the Executive Offic e , for Administration and Finance (ANFS , the Office of the Comptroller fCTR) and the Operational Services Division fOSPt 


, ract I0 „, 8li . commonwealth Departments when another form is not prescribed by regulation or policy. Any changes to the official printed language ol this form shall be 
void. Additional non-conflicting terms may be added by Attachment. Contractors may not require any additional agreements, engagement letters, contract forms or other additional 
terms as part of this Contract without prior Department approval. Click on hyperlinks for definitions, instructions and legal requirements that are incorporated by reference into this 
Contract. An electronic copy of this form Is available at www,mass.gov/osc under Guidance For Vendors - Forms orwww.mass.aov/osd underOSn Forms: 


Fax: 617-625-5400 


CONTRACTOR LEGAL NAME : LOGICWORKBSYSTEMS CORPORATION 
(and d/b/a): 


Legal Address: (W-9, W-4.T&C): 155 Avenue of the Americas, New York, NY 
10013 


Contract Manager: Paul Jacoby 


E-Mail : Pijacoby@logicworks.net 


Phone : 212-625-5300 


Contractor Vendor Code : VC0000722780 


VendorCode Address ID (e.g. "AD001"): AD 001 . 
(Note: The Address fd Must be set up for EFJ payments,) 


X NEW CONTRACT 

PROCUREMENT OR EXCEPTION TYPE : (Check one option only) 

_ Statewide Contract (OSD or an OSD-designated Department) 

_ Collective Purchase (Attach OSD approval, scope, budget) 

— Department Procurement (includes State or Federal grants 815 CMR 2,001 
(Attach RFR and Response or other procurement supporting documentation) 

_ Emergency Contract (Attach justification for emergency, scope, budget) 

_ Contract Employee (Attach Employment Status Form , scope, budget) 

_x_ Leqislative/Leqal or Other : (Attach authorizing language/justification, scope and 
budget) 


C OMMONWEALTH DEPARTMENT NAME : Information Technology Division 
MMARS Department Code: ITD 


Business Mailing Address : One Ashburton Place, Room 804, Boston, MA 02108 


Billing Address (if different): 


Contract Manager: Charles Desourdy 


E-Mail: Charlos,Desourdv@state.ma.u<i 


Phone : 617-660-8329 



MMARS Doc IDfs 


RFR/Procuremeni or Other ID Number: NA 


_ CONTRACT AMENDMENT 

Enter Current Contract End Date Prior to Amendment:_,20_. 

Enter Amendment Amount: S (or ’no change") 

AMENDMENT TYPE : (Check one option only. Attach details of Amendment changes.) 
_ Amendment lo Scope or Budget (Attach updated scope and budget) 

_ Interim Contract (Attach justification for Interim Contract and updated scope/budget) 

_ Contract Employee (Attach any updates to scope or budget) 


_ Leqislative/Lenal or Other: (Attach authorizing language/justification and updated 
scope and budget) 


The following COMMONWEALTH TERMS AND CONDITIONS (T&C) has been executed, filed with CTR amt is incorporated by reference into this Contract. 
JL Commonwealth Terms and Conditions Commonwealth Terms and Conditions For Human and Social Services 


OeMEENMIlQN: (Check ONE option): The Department certifies that payments for authorized performance accepted in accordance with the terms of this Contract will be supported 
in the state accounting system by sufficient appropriations or other non-appropriated funds, subject to intercept for Commonwealth owed debts under 815 CMR 9.00. 

-L Rate Co ntrac t (No Maximum Obligation. Attach details of all rates, units, calculations, conditions or terms and any changes if rates or terms are being amended.) 

— MaxtemPbligation Contract Enter Total Maximum Obligation for total duration of this Contract (or newTotal If Contract is being amended), $_. 


PROMPTj TAYMENT DISCOUN T S ,(PPD)i Commonwealth payments are Issued through EFT 45 days from invoice receipt. Contractors requesting accelerated payments must 
identify a PPD as follows: Payment Issued within 10 days „% PPD; Payment issued within 15 days __ % PPD; Payment issued within 20 days % PPD; Payment Issued within 
30 days _% PPD. If PPO percentages are left blank, identify reason: _agree to standard 45 day cycle _x_ stalutoiy/iegal or Ready Payments (61. c, 29.5 23A 1: _ only initial 
payment (subsequent payments scheduled to support siandard EFT 45 day payment cycle. See PToMPay.Djscounls P olicy,) _ 

BRIEF DESCRIPTION QF C ONTR AC T PERFORMANCE or REASON FOR AMENDMENT : (Enter the Contract title, purpose, fiscal year(s) and a detailed description of the scope 
of performance or what is being amended (or a Coniract Amendment Attach all supporting documentation and justifications.) Pursuant to the attached Logicworks Assignment, 
Delegation, Consent and amendment, the attached coniract between CGI and Loqicwoiks is being assigned to ITD. 


ANTICIPATED START DATE : (Complete ONE option only) The Department and Contractor certify for this Contract, or Contract Amendment, that Contract obligations: 

_x_ 1. may be incurred as of the Effective Date (latest signature date below) and go obligations have been incurred prior lo the Effeclive Dale . 

—2. may be incurred as of _20_, a date LATER than the Effective Date below and no obligations have been Incurred prior to the Effective Date . 

_3, were incurred as of-20__, a date PRIOR to the Effective Dale below, and the parties agree that payments for any obligations incurred prior to the Effective Dale are 

authorized to be made either as settlement payments or as authorized reimbursement payments, and that the details and circumstances of all obligations under this Contract are 
attached and incorporated into this ContracL Acceptance of payments forever releases the Commonwealth from further claims related to these obligations. 


CONTRAC T END DATE: Contract performance shall terminate as of June 30 2015_ t with no new obligations being incurred after this dale unless the Contract is property 

amended, provided that the terms of this Contract and performance expectations and obligations shall survive its termination for the purpose of resolving any claim or dispute, for 
completing any negotiated terms and warranties, to allow any close out or transition performance, reporting, Invoicing or final payments, or during any lapse between amendments. 


Pi 

Pi 
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Complete this section: ONLY if this Contract is brand new, {Complete the 
CONTRACT AMENDMENT section for any material changes to an existing or an 
expired Contract, and for exercising options to renew or annua! contracts under a 
multi-year procurement or grant program.) 

PROCUREMENT OR EXCEPTION TYPE; Check the appropriate type of procurement or 
exception for this Contract. Only one option can be selected. See Slate Finance Law and 
General Requirements. Acquisition Policy and Fixed Assets , the Commodilies and 
Services Policy and the Procurement Information Center (Department Contract Guidance) 
for details. 

Statewide Contract (OSD or an OSD-designated Department). Check this option for a 
Statewide Conlract under OSD, or fay an OSD-designated Department. 

Collective Purchase approved by OSD. Check this option for Contracts approved by 
OSD for collective purchases through federal, state, local government or other entities. 
Department Contract Procurement, Check this option for a Department procurement 
including state granis and federal sub-grants under 815 CMR 2.00 and State Grants and 
F ederal Subqrants Policy, Departmental Master Agreements (MA), if mulli-Department 
user Contract, identify multi-Department use is allowable in Brief Description, 

. The Contract Manager should be an Authorized Emergency Contract. Check this option when the Department has determined that an 

Signatory of, at a minimum, a person designated by the Contractor to represent the unforeseen crisis or incident has arisen which requires or mandates immediate purchases 
Contractor, receive legal notices and negotiate ongoing Contract Issues. The Contract to avoid substantial harm to the functioning of government or the provision of necessary or 
Manager is considered “Key Personnel" and may not be changed without the prior written mandated services or whenever the health, welfare or safety of clients or other persons or 


INSTRUCTIONS AND CONTRACTOR CERTIFICATIONS _ 

The following instructions and terms are incorporated by reference and apply to this 
Standard Contract Form, Text that appears underlined indicates a "hyperlink' to an Internet 
or bookmarked site and are unofficial versions of these documents and Departments and 
Contractors should consult with their legal counsel to ensure compliance wiih all legal 
requirements. Using, the Web Toolbar will make navigation between the form and the 
hyperlinks easier. Please note that not all applicable laws have been cited. 

CONTRACTOR LEGAL NAME (AND D/8/A): Enter the Full Legal Name of the 
Contractor's business as it appears on the Contractor's VW9 or 1AM Form (Contract 
Employees only) and the applicable CommonweaHh Terms and Conditions If Contractor 
also has a "doing business as” (d/b/a) name, BOTH the legal name and the “d/b/a* name 
must appear in this section. 

Contractor Legal Address: Enter the Legal Address of the Contractor as it appears on 
the Contractor's VA9 or W4 Form (Contract Employees only) and the applicable 
Comm onwealth Terms and Conditions , which must match the legal address on the 10991 
table In MMARS (or the Legal Address in HR/CMS for Contract Employee). 

Contractor Contract Manager; Enter the authorized Contract Manager who will be 
responsible for managing (he Contract. 


approval of ibe Department If (he Conlract Is posted on CQMMBUYS . the name of the 
Contract Manager must be included in the Contract on COMMBUYS, 

Contractor E-Mail Address/Phone/Fax; Enter the electronic mail (e-mail) address, 
phone and fax number of the Contractor Contract Manager. This information must be kept 
current by the Contractor to ensure, that the Department can contact the Contractor and 
provide any required legal notices. Notice received by the Contract Manager (with 
confirmation of actual receipt) through the listed address, fax numbers) or electronic mail 
address will meet any written legal notice requirements. 

Contractor Vendor Code; The Department must enter the MMARS Vendor Code 
assigned by the Commonwealth. If $ Vendor Code has not yet been assigned, leave this 
space blank and the Department will complete this section when a Vendor Code has been 
assigned. The Department is responsible under the Vendor File and W-9s Policy for 
verifying with authorized signatories of the Contractor, as part of contract execution, that 
the legal name, address and Federal Tax Identification Number (TIN) in the Contract 
documents match the state accounting system. 

Vendor Code Address ID: (e.g., “AD001") The Department must enter the MMARS 
Vendor Code Address Id identifying the payment remittance address for Contract 
payments, which MUST be set up for EFT payments PRIOR to the first payment under the 
Contract in accordance with the Bill Paving and Vendor File and W-9 policies. 
COMMONWEALTH DEPARTMENT NAME: Enter the full Department name with the 
authority to obligate funds encumbered for the Contract. 

Commonwealth MMARS Alpha Department Code: Enter the three (3) letter MMARS 
Cgdeassigned to this Commonwealth Department in the state accounting system. 
Department Business Mailing Address: Enter the address where ail formal 
correspondence to the Department must be sent, Unless otherwise specified in the 
Contract, legal notice sent or received by the Department’s Contract Manager (with 
confirmation of actual receipt) through the listed address, fax numbers) or electronic mail 
address for the Contract Manager will meet any requirements for legal notice. 

Department Billing Address: Enter the Billing Address or email address if invoices must 
be sent to a different location. Billing or confirmation of delivery of performance issues 
should be resolved through tee listed Contract Managers. 

Department Contract Manager: Identify the authorized Contract Manager who will be 
responsible for managing the Contract, who should be an aulhorized signatory or an 
employee designated by ihe Department to represent the Department to receive legal 
notices and negotiate ongoing Contract issues. 

Department E-Mail Address/Phone/Fax: Enter tee electronic mail (e-mail) address, 
phone and fax number of tee Department Contract Manager. Unless otherwise specified in 
the Contract, legal notice sent or received by tee Contract Manager (with confirmation of 
actual receipt) through the listed address, fax number® or electronic mail address will 
meet any requirements for written notice under tee Contract. 

MMARS Document ID(s): Enter the MMARS 20 character encumbrance transaction 
number associated with this Contract which must remain the same for Ihe life of the 
Contract. If multiple numbers exist for this Contract, Identify all Doc Ids. 

RFRIProcurement or Other ID Number or Name: Enter the Request for Response 
(RFR) or other Procurement Reference number. Contract ID Number or other 
reference/tracking number for this. Contract or Amendment and will be entered Into the 
Board Award Field in the MMARS encumbrance transaction for this Contract. 


NEW CONTRACTS (left side of Foml): 


serious damage to property is threatened. 

Contract Employee. Check this option when Ihe Department requires the performance of 
an Individual Contractor , and when the planned Contract performance with an individual 
has been classified using tee Employment Status Form (prior to the Contractors selection) 
as work of a Contract Employee and not teat of an Independent Contractor. 
LegislativeiLegal or Other. Check this option when legislation, an existing legal 
obligation, prohibition or other circumstance exempts or prohibits a Contract from being 
competitively procured, or. identify any other procurement exception not already listed. 
Legislative 'earmarks" exempl the Contract solely from procurement requiremenls, and all 
other Contract and state finance laws and policies apply. Supporting documentation must 
be attached lo explain and justify tee exemption. _ 

CONTRACT AMENDMENT (Right Side ofFormT^ 

Complete this section for any Contract being renewed, amended or to continue a lapsed 
Contract All Contracts with available options to renew must be amended referencing tee 
original procurement and Contract doc ids, since ail continuing conlracis must be 
maintained in ihe same Conlract (He (even it tee underlying appropriation changes each 
fiscal year.) "See Amendments. Suspensions, and Termination Policy .) 

Enter Current Contract End Date: Enter the termination date of the Current Contract 
being amended, even if ihis date has already passed. (Note: Current Start Date is not 
requested since this dale does not change and is already recorded in MMARS,) 

Enter Amendment Amount: Enter tee amount of (he Amendment increase or decrease to 
a Maximum Obligation Contract Enter “no change" for Rate Contracts or if no change. 
AMENDMENT TYPE: Identify the type of Amendment being done. Documentation 
supporting tee updates to performance and budget must be attached. Amendment to 
Scope or Budget. Check this option when renewing a Contract or executing any 
Amendment ("material change" in Contract terms) even if fhe Contract .has lapsed. The 
parties may negotiate a change in any element of Contract performance or cost identified 
in the RFR or ihe Contractor's response which results in lower costs, or a more cost- 
effective or better value performance than was presented in tee original selected response, 
provided Ihe negotiation results in a better value within the scope of tee RFR than what 
was proposed by the Contractor In tee original selected response. Any 'material’ change 
in tee Contract terms must be memorialized in a formal Amendment even if a 
corresponding MMARS transaction is not needed to support the change, Additional 
negotiated terms will lake precedence over tee relevant terms in the RFR and Ihe 
Contractor’s Response only if made using ihe process outlined in 801 CMR 21.07 , 
incorporated herein, provided that any amended RFR or Response terms result in best 
Value, lower costs, or a more cost effective Contract. 

Interim Contracts. Check this option for an Interim Conlract to prevent a lapse of Contract 
performance whenever an existing Contract is being re-procured but tee new procurement 
has not been completed, to bridge tee gap during implementation between an expiring and 
a new procurement, or to contract with an interim Contractor when a current Contractor is 
unable to complete full performance under a Contract. 

Contract Employee. Check this option when tee Department requires a renewal or other 
amendment lo tee performance of a Contract Employee. 

LegislativeiLegal or Other. Check this option when legislation, an existing legal 
obligation, prohibition or other circumstance exempts or prohibits a Contract from being 
competitively procured, Or identify any other procurement exception not already listed. 
Legislative "earmarks* exempt tee Contract solely from procurement requirements, and all 
other Conlract and state finance laws and policies apply. Attach supporting documentation 
to explain and Justify tee exemption and whether Contractor selection has been publicly 
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posted. 

_ COMMONWEALTH TERMS AND CONDITIONS 

Identify which Commonwealth Terms and Conditions the Contractor has executed and is 
incorporated by reference into this Contract. This Form is signed only once and recorded 
on the Vendor Customer File (VCUST). See Vendor File and W-9s Policy. 

COMPENSATION 

Identify if the Contract is a Rate Contract (with no stated Maximum Obligation) or a 
Maximum Obligation Contract (with a stated Maximum Obligation) and identity the 
Maximum Obligation., If the Contract is being amended, enter the new Maximum 
Obiigalion based upon the increase or decreasing Amendment. The Total Maximum 
Obligation must reflect the total funding for the dates of service under the contract, 
including the Amendment amount if the Contract is being amended. The Maximum 
Obligation must match the MMARS encumbrance. Funding and allotments must be 
verified as available and encumbered prior to incurring obligations. If a Contract includes 
both a Maximum Obligation component and Rate Contract component, check oil both, 
specific Maximum Obligation amounts or amended amounts and Attachments must dearly 
outline the Contract breakdown to match the encum brance. 

PAYMENTS AND PROMPT PAY DISCOUNTS 
Payments are processed within a 45 day payment cycle through EFT in accordance with 
the Commonwealth Bill Paying Policy for investment and cash flow purposes. 
Departments may NOT negotiate accelerated payments and Payees are NOT entitled to 
accelerated payments UNLESS a prompt payment discount (PPD) Is provided to support 
the Commonwealth's loss of investment earnings for this earlier payment, or unless a 
payments Is legally mandated to be made in less than 45 days (eg., construction 
contracts. Ready Payments under G.L . c. 29, s. 23A). See Prompt Pay Discounts Policy . 
PPD are identified as a percentage discount which will be automatically deducted when an 
accelerated payment is made. Reduced contracts rates may not be negotiated to replace a 
PPD. If PPD fields are left blank please identify that the Contractor agrees to the standard 
45 day cycle; a statutory/fegal exemption such as Ready Payments ( G.L, c. 29.4 23A 1: or 
only an initial accelerated payment for reimbursements or start up costs for a grant with 
subsequent payments scheduled to support standard EFT 45 day payment cycle. Financial 
hardship is not a sufficient Justification to accelerate cash (low for all payments under a 
Contract. Initial grant or contract payments may be accelerated for the first invoice dr Initial 
grant installment, but subsequent periodic installments or invoice payments should be 
scheduled to support the Payee cash flow needs and the standard 45 day EFT payment 
cycle in accordance with the Bill Paying Policy. Any accelerated payment that does, not 
provide for a PPD must have a legal justification In Contract file for audit purposes 
explaining why accelerated payments were allowable witho ut a PPD. 

__ BRIEF DESCRIPTION OF CONTRACT PERFORMANCE _ 

Enter a brief description of the Contract performance, project name and/or other identifying 
information for the Contract to specifically identify the Contract performance, match the 
Contract with attachments, determine the appropriate expenditure code (as listed in the 
Expenditure Classification Handbook ) or to identify or clarity important Information related 
to the Contract such as the Fiscal Year(s) of performance (ex. “FY2012" or"FY2Q12-14'). 
Identify settlements or other exceptions and attach more detailed justification and 
supporting documents. Enter “Multi-Department Use' if other Departments can access 
procurement. For Amendments, identify the purpose and what Items are being amended. 
Merely stating “see attached" or referencing attachments without a narrative description of 
performance Is insufficient. 

_ ANTICIPATED START DATE 

The Department and Contractor must certify WHEN obligations under this 
Contract/Amendment may be incurred. Option 1 is the default-option when performance 
may begin as of the Effective Date (latest signature date and any required approvals). If 
the parties want a new Contract or renewal to begin as of the upcoming fiscal year then list 
the fiscal year(s) (ex. "FY2012' or 'FY2012-14") in the Brief Description section. 
Performance starts and encumbrances reflect the default Effective Date (if no FY is listed) 
or the later FY start date (If a FY is listed). Use Option 2 only when the Contract will be 
signed well in advance of the start date and identify a specific future start date. Do not use 
Option 2 for a fiscal year start unless it is certain that the Contract will be signed prior to 
fiscal year. Option 3 is used in lieu of the Settlement and Release Form when, the 
Contract/Amendment is signed late, and obligations have already been incurred by the 
Contractor prior to the Effective Date for which the Department has either requested, 
accepted or deemed legally eligible for reimbursement, and the Contract includes 
supporting documents justifying the performance or proof of eligibility, and approximate 
costs. Any obligations incurred outside the scope of the Effective Date under any Option 
listed, even If the Incorrect Option is selected, shall be automatically deemed a settlement 
included under the terms of the Contract and upon payment to the Contractor will release 
the Commonwealth from further obligations for the identified performance. Ail settlement 
payments require justification and must be under same encumbrance and object codes as 
the Contract payments. Performance dales are subject to G.L. c.4.59 . 


_ CONTRACT END DATE _____ 

The Department must enter the date that Contract performance will terminate. If the 
Contract Is being amended and the Contract End Date is not changing, this date 
must be re-entered again here. A Contract must be signed for at feast the initial duration 
but not longer than the period of procurement listed in the RFR, or other solicitation 
document (if applicable). No new performance is allowable beyond the end dale without 
an amendment, but the Department may allow a Contractor to complete minimal close out 
performance obligations if substantial performance has been made.priorto the termination 
date of the Contract and prior to the end of the fiscal year in which payments are 
appropriated, provided that any close out performance is subject to appropriation and 
funding limits under slate finance taw, and CTR may adjust encumbrances and payments 
in the stale accounting system to enable final close out payments. Performance dates are 
subject to G.L. c.4.5 9 , 

CERTIFICATIONS AND EXECUTION 

See Department Head Sionaiure Authorization Policy and the Contractor Authorized 
Signatory Listing for policies on Contractor and Department signatures. 

Authorizing Signature for Contractor/Date: The Authorized Contractor Signatory must 
(in their own handwriting and in ink) sign AND enter Ihe date the Contract is signed. See 
section above, under “ Anticipated Contract Start Date *. Acceptance of payment by the 
Contractor shall waive any right of Ihe Contractor to claim the Contract/Amendment is not 
valid and the Contractor may not void the Contract Rubber stamps, typed or other 
images are not acceptable. Proof of Contractor signature authorization on a Contractor 
Authorized Signatory Listing may be required by the Department if not already on file. 
Contractor Name /Title: The Contractor Authorized Signatory’s name and title must 
appear legibly as it appears on the Contractor Authorized Signatory Listing . 

Authorizing Signature For Commonwealth/Date: The Authorized Department Signatory 
must (in their own handwriting and in ink) sign AND enter the date the Contract is signed. 
See section above under “ Anticipated Start Dale '. Rubber stamps, typed or other 
images are not accepted. The Authorized Signatory must be an employee within the 
Department legaliy responsible (or the Contract. See Department Head Stanature 
Authorization . The Department must have the legislative funding appropriated for all the 
costs of this Contract or funding allocated under an approved Interdepartmental Service 
A greement (ISAi. A Department may not contract tor performance to be delivered to or by 
another stale department without specific legislative authorization (unless this Contract Is a 
Statewide Contract), For Contracts requiring Secretariat signoff, evidence of Secretariat 
signoff must be Included in the Contract file. 

Department Name /Title; Enter the Authorized Signatory's name and title legibly. 

CONTRACTOR CERTIFICATIONS AND LEGAL REFERENCES 

Notwithstanding verbal or other representations by Ihe parties, the ''Effective Date” of this 
Contract or Amendment shall ba the latest dale that this Contract or Amendment has been 
executed by an authorized signatory of the Contractor, the Department, or a later Contract 
or Amendment Start Date specified, subject to any requited approvals. The Contractor 
makes all certifications required under this Contract under the pains and penalties of 
perjury, and agrees -to provide any required documentation upon request to support 
compliance, and agrees that all terms governing performance of this Contract and doing 
business in Massachusetts are attached or incorporated by reference hereto; 
Commonwealth and Contractor Ownership Rights. The Contractor certifies and agrees 
that the Commonwealth is entitled to ownership and possession of ail 'deliverables' 
purchased or developed with Contract funds. A Department may not relinquish 
Commonwealth rights to deliverables nor may Contractors sell products developed with 
Commonwealth resources without just compensation. The Contract should detail ail 
Commonwealth deliverables and ownership rights and any Contractor proprietary rights. 
Qualifications. The Contractor certifies it is qualified and shall at all times remain qualified 
to perform this Contract; that performance shall be timely and meet or exceed industry 
standards for the performance required, including obtaining requisite licenses, 
registrations, permits, resources for performance, and sufficient professional, liability; and 
other appropriate insurance to cover the performance, If the Contractor is a business, the 
Contractor certifies that it is listed under the Secretary of State's Website as licensed to do 
business in Massachusetts, as required by law. 

Business Ethics and Fraud, Waste and Abuse Prevention. The Contractor certifies that 
performance under this Contracl, in addition to meeting the teims of the Contact, will be 
made using ethical business standards and good stewardship of taxpayer and other public 
funding and resources to prevent fraud, waste and abuse. 

Collusion. The Conlrador certifies that this Contract has been offered In good faith and 
without collusion, fraud or unfair trade practices with any other person, that any actions to 
avoid or frustrate fair and open competition are prohibited by lav/, and shall be grounds for 
rejection or disqualification of a Response or termination of this Contract. 

Public Records and Access The Contractor shall provide full access to records related to 
performance and compliance to the Department and officials listed under Executive Order 
195 and G.L. c, 11, s.12 seven (7) years beginning on the first day after the final payment 
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under this Contract or such longer period necessary for the resolution of any litigation, 
claim, negotiation, audit or other inquiry involving this Contract. Access to view Contractor 
recofds related to any breach or allegation of fraud, waste and/or abuse may not be denied 
and Contractor can not claim confidentiality or trade secret protections solely for viewing 
but not retaining documents. Routine Contract performance compliance reports or 
documents related to any alleged breach or allegation of non-compliance, fraud, waste, 
abuse or collusion may be provided electronically and shall be provided at Contractor's 
own expense. Reasonable costs for copies of non-routine Contract related records shall 
not exceed the rates for public records under 950 C.M.R. 32.00 . 

Debarment. The Contractor certifies that neither it nor any of its subcontractors are 
currently debarred or suspended by the federal or State government under any law or 
regulation Including, Executive Order 147 : G,L,o. 29.S.29F G.L, c.30. S 39R. G.L c, 149,6 
2/C, Gl, atrip. 644C . G.L. c.149. S148B and G.L. c, 152. s. 25C. 

Applicable Laws. The Contractor shall comply with all applicable state laws and 
regulations including but not limited to the applicable Massachusetts General Laws : the 
°^ c ' al Code of tvlassachusetts Regulations : Code of Massachusetts Regulations 
(unofficial); 80 1 Ci.iR 21,0 0 (Procurement of Commodity and Service Procurements, 
Including Human and Social Services); 815 CMR 2(00 (Grants and Subsidies); 808 CMR 
100 (Compliance, Reporting and Auditing for Human And Social Services); AICPA 
Standard s; conlidentlality of Department records under G.L. c. G6A: and the 
Massachusetts Constitution Article XVIII if annllcahle. 

Invoices. The Contractor must submit invoices in accordance with the terms of the 
Contract and the Commonwealth Bill Paving Policy . Contractors must be able to reconcile 
and property attribute concurrent payments from multiple Departments, Final invoices in 
any fiscal year must be submitted no later than August 15* for performance made and 
received (goods delivered, services completed) prior to June 30*, in order to make 
payment for that performance prior to Ihe close of the fiscal year to prevent reversion of 
appropriated funds. Failure to submit timely invoices by August 15* or other date listed in 
the Contract shall authorize the Department to issue an estimated payment based upon 
the Department’s determination of performance delivered and accepted. The Contractor’s 
acceptance of this estimated payment releases the Commonwealth from further claims for 
these Invoices. If budgetary funds revert due to the Contractor's failure to submit timely 
final invoices, or for disputing an estimated payment, Ihe Department may deduct a penalty 
up to 10% from any final payment in the next fiscal year for failure to submit timely invoices. 
Payments Subject To Appropriation. Pursuant to G.L. c. 29 § 26, § 27 and § 29, 
Departments are required to expend funds only for the purposes set forth by the 
Legislature and within (he funding limits established through appropriation, allotment and 
subsidiary, including mandated allotment reductions triggered by G.L, c. 29. 6 9C . A 
Department cannot authorize or accept performance in excess of an existing appropriation 
and allotment, or sufficient non-appropriated available funds. Any ora! or written 
representations, commitments, or assurances made by the Department or any other 
CommonWeallh representative are not binding. The Commonwealth has no legal 
obligation to compensate a Contractor for performance that is not requested and is 
intentionally delivered by a Contractor outside the scope of a Contract Contractors should 
verify funding prior to beginning performance. 

intercept. Contractors may be registered as Customers in the Vendor file if the Contractor 
owes a Commoriweallh debt. Unresolved .and undisputed debts, and overpayments of 
Contract payments that are not reimbursed timely shall be subject to intercept pursuant to 
0., k . c. 7A, s. J and 815 CMR 9.00 . Contract overpayments will be subject to immediate 



intercept or payment offset. The Contractor may not penalize any state Department or 
assess late fees, cancel a Contract or other services if amounts are intercepted or offset 
due to recoupment of an overpayment, outstanding taxes, child support, other overdue 
debts or Contract overpayments, 

Tax Law Compliance. The Contractor certifies under the pains and penalties of perjury 
tax compliance with Federal lax laws : slate tax laws including but not limited to G.L. c. 62C. 
G.L o. 62C. s. 49A: compliance with all state tax laws, reporting of employees and 


services are required to identify any potential conflict with representation of any 
Department client in accordance with Massachusetts Board of Bar Overseers (BBO) rules. 
Federal Anti-Lobbying and Other Federal Requirements. If receiving federal funds, the 
Contractor certifies compliance with federal anti-lobbying requirements Including 31 USC 
1352; other federal requirements : Executive Order 11246 - Air Pollution Act ; Federal Water 
Pollution Control Act and Federal Employment taws . 

Protection of Personal Data and information. The Contractor certifies that all steps will 
be taken to ensure the security and confidentiality of all Commonwealth data tor which the 
Contractor becomes a holder, either as part of performance or inadvertently during 
performance, with special attention to restricting access, use and disbursement of personal 
data and information under G.L, c. 93H and c. 66A and Executive Order 5(14 . The 
Contractor is required to.comply with G.L. c. 931 for the proper disposal ol all paper and 
electronic media,, backups or systems containing personal data and Information, provided 
further that the Contractor is required to ensure that any personal data or information 
transmitted electronically or through a portable device be. properly encrypted using (at a 
minimum) Information Technology Division flTDS Protection of Sensitive Information , 
provided further that any Contractor having access to credit card or banking information of 
Commonwealth customers certifies that the Contractor is PCI compliant in accordance with 
the Payment Card Industry Council Standards and shall provide confirmation compliance 
during the Contract, provide further lhat the Contractor shall immediately notify the 
Department in the event of any securily breach including the unauthorized access, 
disbursement, use or disposal of personal, data or information, and in the event of a 
security breach, the Contractor shall cooperate fully with the Commonwealth and provide 
access to any Information necessary for the Commonwealth to respond to Ihe security 
breach and shall be fully responsible for any damages associated with the Contractor's 
breach including but not limited to G.L. c, 214, s. 3B, 

Corporate and Business Filings and Reports. The Contractor certifies compliance with 
any certification, filing, reporting and service oi process requirements of the Secretary of 
the Commonwealth, the Office of ihe Attorney General or other Departments as related to 
its conduct of business in the Commomveallh; and with its incorporating state (or foreign 
entity). 

Employer Requirements. Contractors that are employers certify compliance with 
applicable state and federal employment laws or regulations, including but not limited to 
fiLkoJLsJ. (Prevailing Wages for Printing and Distribution of Public Documents); G.L. c. 
7, s. 22 (Prevailing Waaes for Contracts for Meat Products and Clothing-and Acparell : 
roinlmumwages and prevailing wage programs arid payments : unemployment insurance 
and contributions: workers’ compensation and insurance , child labor laws . AGO fair labor 
practices ; G.L. c. 149 (Labor and Industries); G.L. c. 150A (Labor Relations); G.L. c. 151 
and 455 CMR 2.00 (Minimum Fair Wages): G.L. c. 151A (Employment and Training); G. L. 
cl 151B (Unlawful Discrimination); G.L c. 151E (Business Discrimination); G.L.’ c. 152 
(Workers’ Compensation); G.L. c.153 (Liability for Injuries); 29 USC c. 8 (Federal Fair 
Labor Standards); 29 USC c. 28 and the Federal Family and Medical Leave Act . 

Federal And State Laws And Regulations Prohibiting Discrimination including but not 
limited to the Federal Equal Employment Opportunity (EEO) Laws the Americans with 
Disabilities Act .; 42U.S.C Sec. 12,101, etseo., the Rehabilitation Act , 29 USC c. 16 s. 794 : 
29 USC c. 16. s. 701 ; 29 USCc. 14,623: the 42 USC c.45; (Federal Fair Housing Act); a - 
L, c. 151B (Unlawful Discrimination); G.L. c, 1S1E (Business Discrimination); ihe Public 
Accommodations Law G.L, c. 272, s. 92A: G.L, c. 272, s. 98 and 98A, Massachusetts 
Constitution Article CXIV and G.L. c. 93. s. 103: 47 USC C. 5. sc, II. Part II. s. 255 


contractors, withholding and remitting of tax withholdings and child support and is in good 
standing with respect to all state taxes and returns due; reporting of employees and 
contractors under G._L . c, 62E . withholding and remitting child support including G.L. c. 
1134 s. 12; TIR 05-11; New Independent Contractor Provisions and applicable TIRs . 
Bankruptcy, Judgments, Potential Structural Changes, Pending Legal Matters and 
Conflicts. The Contractor certifies It has not been in bankruptcy and/or receiverahip within 
Ihe last three calendar years, and the Contractor certifies that it will immediately notify the 
Department in writing at least 45 days prior to filing for bankruptcy and/or receivership, 
any potential structural change in its organization, or if there is any risk to the solvency of 
the Contractor that may impact the Contractor’s ability to timety fulfill Ihe terms of this 
Contract or Amendment The Contractor certifies that at any time during Ihe period of the 
Contract the Contractor is required to affirmatively disclose in writing to the Department 
Contract Manager the details of any judgment, criminal conviction, Investigation or litigation 
pending against the Contractor or any of its officers, directors, employees, agents, or 
subcontractors, including any potential conflicts of Interest of which the Contractor has 
knowledge, or teams of during the Contract term. Law firms or Attorneys providing legal 


(Telecommunication Acl; Chapter 149, Section 105D, G.L. c. ISJC, G.Lc, 272, Section 
i 2Au Se ction. 98 and Section 98A. and G.L. o. Ill, Section 199A. and Massachusetts 
Disability-Based Non-Discriminallon Standards For Executive Branch Entities, and related 
Standards and Guidance, authorized under Massachusetts Executive Order or any 
disability-based protection arising from State or federal law or precedent. See also MCAD 
and MCAD links and Resources . 

Small Business Purchasing Program (SBPP). A Contraclor.may be eligible to 
participate in the SBPP, created pursuant to Executive Order S23 . if qualified Ihrough the 
SBPP COMMBUYS subscription process at: www.commbuys.com and with acceptance of 
the terms of the SBPP participation agreement 

Limitation of Liability for Information Technology Contracts (and other Contracts 3 S 
Authorized). The Information Technology Mandatory Specifications and the IT Acquisition 
Accessibility Contract Lanouaae are Incorporated by. reference into Information Technology 
Contracts, The following language will apply to Information Technology contracts In the 
U01, U02, U03, U04, U05, U06, U07, U08, U09, U10, U75, U98 object codes in the 
Expenditure Classification Handbook or other Contracts as approved by CTR or OSD. 
Pursuant to Section 11. Indemnification ol the Commonwealth Terms and Conditions, Ihe 
term "other damages' shall include, but shall not be limited to, the reasonable costs the 
Commonwealth incurs io repair, return, replace or seek cover (purchase of comparable 
substitute commodities and services) under a Contract. "Other damages" shall not include 
damages to the Commonwealth as a result of third party claims, provided, however, that 
the foregoing in no way limits the Commonwealth's right of recovery for personal injury or 
property damages or patent and copyright infringement under Section 11 nor the 
Commonwealth's ability to join the contractor as a third party defendant Further, the term 
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“other damages' shall not include, and in no event shall the contractor be liable for, 
damages for the Commonwealth's use of contractor provided products or services, loss of 
Commonweallh records, or data (or other infangibfe property), toss of use of equipment, 
lost revenue, lost savings or lost profils of the Commonweallh. In no event shall ‘other 
damages exceed the greater of 5100,000, or two times the value of the product or.servlce 
(as defined in the Contract scope of work) that is the subject of the claim. Section 11 sets 
forth the contractor's entire liability under, a Contract Nothing in this section shall limit the 
Commonwealth’s ability to negotiate higher limitations of liability in a particular Contract, 
provided that any such limitation must specifically reference Section 11 of the 
Commonweallh Terms and Conditions. In the event the limitation of liability conflicts with 
accounting standards which mandate that there can be no cap of damages, the limitation 
shall be considered waived for that audit engagement. These terms may be. applied to 
other Contracts only with prior written confirmation from the Operational Services Division 
or the Office of the Comptroller, The terms in this Clarification may not be modified. 
Northern Ireland Certification. Pursuant to G.L, c. 7 s. 22C for state agencies, slate 
authorities, the House of Representatives or the state Senate, by signing this Coniract the 
Contractor certifies that it does not employ ten or more employees in an office or other 
facility in Northern Ireland and if the Contractor employs ten or more employees in an office 
or other facility located in Northern Ireland the Contractor certifies that it does not 
discriminate in employment, compensation, or the terms, conditions and privileges of 
employment on account of religious or political belief; and it promotes, religious tolerance 
within the work place, and the eradication of any manifestations of religious and other 
illegal discrimination; and the Contractor is not engaged In tire manufacture, distribution or 
sate of firearms, munitions, including rubber or plastic bullets, fear gas, armored vehicles or 
military aircraft for use ordeployment in any activity in Northern Ireland. 

Pandemic, Disaster or Emergency Performance. In the event of a serious emergency, 
pandemic or disaster outside the control of the Department, the Department may negotiate 
emergency performance from the Contractor to address the immediate needs of the 
Commonwealth even if not contemplated under the original Contract or procurement. 
Payments are subject (o appropriation and other payment terms. 

Consultant Contractor Certifications (For Consultant Contracts "HH" and "NN" and 
U05 object codes subject to G.L. Chanter 29. s. 2SA) . Contractors must make required 
disclosures as part of the RFR Response or using the Consultant Contractor Mandatory 
Submission Form . 

Attorneys. Attorneys or firms providing legal services or representing Commonwealth 
Departments may be subject to G.L, c. 30. s,65 , and if providing litigation services must be 
approved by the Office of the Attorney General (o appear on behalf of a Department, and 
shall have a continuing obligation to notify the Commonwealth of any conflicts of interest 
arising under the Contract. 

Subcontractor Performance. The Contractor certifies full responsibility for Contract 
performance, including subcontractors, and that comparable Contract terms will be 
included in subcontracts, and that the Department will not be required to directly or 
indirectly manage subcontractors or have any payment obligations to subcontractors.. 

__ EXECUTIVE ORDERS ____ 

For covered Executive state Departments, the Contractor certifies compliance with 
applicable Executive Orders (see also Massachusetts Executive Orders! . Including but not 
limited to the specific orders listed below. A breach during period of a Contract may be 
considered a material breach and subject Contractor to appropriate monetary or Contract 
sanctions. 

Executive Order 481. Prohibiting the Use of Undocumented Workers on State Contacts . 
For all stale agencies In the Executive Branch, including ail executive offices, boards, 
commissions, agencies, Departments, divisions, councils, bureaus, and offices, now 
existing and hereafter established, by signing this Coniract the Contractor certifies under 
Ihe pains and penalties of perjury that they shall not knowingly use undocumented workers 
in connection with the performance of this Contract; that, pursuant to federal requirements, 
shall verify the immigration status of workers assigned to a Contract without engaging in 
unlawful discrimination; and shall not knowingly or recklessly alter, falsify, or accept altered 
or falsified documents from any such worker 

Executive Order 130 . Anti-Boycott . The Contractor warrants, represents and agrees that 
during the time this Contract is in effect, neither it nor any affiliated company, as hereafter 
defined, participates in or cooperates with an international boycott.(See IRC 999lbl(3f- 
Ml. and IRS Audit Guidelines Boycotts) or engages in conduct declared to be unlawful by 
G.L. c; 151E, $. 2 . A breach in the warranty, representation, and agreement contained In 
ihis paragraph, without limiting such other rights as it may have, the Commonwealth shall 
be entitled to rescind this Contract. As used herein, an affiliated company shall be any 
business entity of which at least 51% of the ownership interests are directly or indirectly 
owned by the Contractor or by a person or persons or business entity or entities directly or 
indirectly owning at least 51% of the ownership interests of the Contractor, or which directly 
or indirectly owns at least 51% of the ownership interests of Ihe Contractor. 

Executive Order 346 . Hiring of State Employees By Slate Contractors Contractor certifies 
compliance with both the conflict of interest law G.L. c. 268A specifically s. 5 fit and this 
orden and includes limitations regarding the hiring of state employees: by private 
companies contracting with the Commonwealth. A privatization contract shall be deemed 


io include a specific prohibition against the hiring at any time during ihe term of Coniract,. 
and for any position inthe Contractor's company, any slate management employee who is, 
was, or will be Involved in Ihe preparation of the RFP, the negotiations leading to the 
awarding of the Contract, Ihedecision to award the Contract, and/or ihe supervision or 
oversight of performance under the Coniract. 

Executive Order 444 . Disclosure of Family Relationships With Other State Employees . 
Each person applying for employment (including Contract work) within Ihe Executive 
Branch under Ihe Governor must disclose in writing the names of all immediate family 
related lo immediate family by marriage who serve as employees or elected officials of Ihe 
Commonwealth. All disclosures made by applicants hired by the Executive Branch.under 
the Governor shall be made available for public inspection to the extent permissible by law 
by the official with whom such disclosure has been filed. 

Executive Order 504 . Regarding ihe Security and Confidentiality of Personal Information , 
For all Conlracls involving the Contractor’s access to personal information, as defined in 
G.L. c, 93H , and personal data, as defined in G.L. c. 66A. owned or controlled by 
Executive Department agencies, or access to agency systems containing such information 
or date (herein colfectively “personal information"), Contractor certifies under the pains and 
penalties of pequry that the Contractor (1) has read Commonwealth of Massachusetts 
Executive Order 504 and agrees io protect any and all personal information; and (2) has 
reviewed all of the Commonwealth I nformation Technology Divisfon’s Security 
Policies , Notwithstanding any.contractual provision to the contrary, in connection with ihe 
Contractor's performance under Ihis Contract, for all slate agencies in the Executive 
Department, including all executive offices, boards, commissions, agencies, departments, 
divisions, councils, bureaus, and offices, now existing and hereafter established, the 
Contractor shall: (1) obtain a copy, review, and comply with the contracting agency's 
Information Security Program (ISP) and any pertinent security guidelines, standards, and 
policies; (2) comply with all of the Commonwealth of Massachusetts Information 
Technology Division's "Security Policies "! f3i communicate and enforce the contracting 
agency's ISP and such Security Policies against all employees (whether such employees 
are direct or contracted) and subcontractors; (4) implement and maintain any other 
reasonable appropriate security procedures and practices necessary to protect personal 
information to which the Contractor is given access by the contracting agency from the 
unauthorized access, destruction, use, modification, disclosure or loss; (5) be responsible 
for the full or partial breach of any of these terms by its employees (whether such 
employees are direct or contracted) or subcontractors during or after the term of this 
Contract, and any breach of these terms may be regarded as a material breach of this 
Contract; (6) In Ihe event of any unauthorized access, destruction, use, modification, 
disclosure of loss of ihe personal information (collectively referred lo as Ihe "unauthorized 
use’): (a) immediately notify Ihe contracting agency il the Contractor becomes aware of the 
unauthorized use; (b) provide full cooperation and access to information necessaiy for ihe 
contracting agency to determine Ihe scope of the unauthorized use; and (c) provide full 
cooperation and access to information necessary for the contracting agency and the 
Contractor io fulfill any notification requirement, Breach of these terms may be regarded 
as a material breach of this Contract, such that Ihe Commonweallh may exercise any and 
all contractual rights and remedies, including without limitation indemnification under 
Section 11 of the Commonwealth's Terms and Conditions, withholding of payments, 
Contract suspension, or termination. In addition, the Contractor may be subject to 
applicable statutory or regulatory penalties, including and without limitation, those imposed 
pursuant to G.L. c. 93H and under G.L. c. 214, S3B for violalions under M.G.l c. 66A. 
Executive Orders 523, 524 and 526. Executive Order 526 (Order Regarding Non- 
Dlscriminalion, Diversity, Equal. Opportunity and Affirmative Action which supersedes 
Executive Order 476) . Executive Order 524 (Establishing the Massachusetts Supplier 
Diversity Program which supersedes Executive Order 390). Executive Order 523 
(Establishing the Massachusetts Small Business Purchasing Program,) All programs, 
activities, and services provided, performed, licensed, chartered, funded, regulated, or 
contracted for by the state shall be conducted without unlawful discrimination based on 
race, color, age, gender, ethnicity, sexual orientation, gender identity or expression, 
religion, creed, ancestry,.national origin, disability, veteran's status (including Vietnam-era 
veterans), or background,. The Contractor and any subcontractors may not engage in 
discriminatory employment practices;. and the Contractor certifies compliance with 
applicable federal and state laws, rules, and regulations governing fair labor and 
employment practices; and the Contractor commits to purchase supplies and services from 
certified minority or women-owned businesses, small businesses, or businesses owned by 
socially or economically disadvantaged persons or persons with disabilities. These 
provisions shall be enforced through the contracting agency, OSD, and/or Ihe 
Massachusetts Commission Against Discrimination. Any breach shall be regarded as a 
material breach of the coniract that may subject the contractor to appropriate sanctions. 
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CONTRACTOR VENDOR/CUSTOMER CODE: \J QV'QV 7 21-1^0 
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INSTRUCTIONS: Any Contractor (other than a sole-proprietor or an individual contractor) must provide a listing of 
individuals who are authorized as legal representatives of the Contractor who can sign contracts and other legally binding 

documents* related to the contract on the Contractor's behalf. In addition to this listing, any state department may require 
additional proof of authority to sign contracts on behalf of the Contractor, or proof of authenticity of signature (a notarized 
signature that the Department can use to Verify that the signature and date that appear on the Contract or other legal 

document was actually made by the Contractor's authorized signatory, and not by a representative, designee or other 
individual.) 


NOTICE: Acceptance of any payment under a Contract or Grant shall operate as a waiver of any defense by the 
Contractor challenging the existence of a valid Contract due to an alleged lack of actual authority to execute the 
document by the signatory. 


For privacy purposes DO NOT ATTACH any documentation containing personal information, such as bank account 
numbers, social security numbers, driver’s licenses, home addresses, social security cards or any other personally 

identifiable information that you do not want released as part of a public record. The Commonwealth reserves the right to 
publish the names and titles of authorized signatories of contractors. 


AUTHORIZED SIGNATORY NAME 

TITLE 

_j CJlf) 'Zie^h-C 

CEO 


i/ P trp ScIcj 4- C Lm 'i S y ^ ias 

M1 1 Ut h eJi r a O 

1 / f o-P "7 e cP n< c « 1 Opx-.-iUn (, 

_'75‘oWa PwA 

V f O “f C Cfc .1 c~/r r r 

AA» c h-c Ifg (7t >• <m 

CaPV f "W& if y 


I certify that I am the President, Chief Executive Officer, Chief Fiscal Officer, Corporate Clerk or Legal Counsel for the 
Contractor and as an authorized officer of the Contractor I certify that the names of the individuals identified on this 
listing are current as of the date of execution below and that these individuals are authorized to sign contracts and other 
legally binding documents related to contracts with the Commonwealth of Massachusetts on behalf of the Contractor. I 
understand and agree that the Contractor has a duty to ensure that this listing is immediately updated and communicated to 
any state department with which the Contractor does business whenever the authorized signatories above retire, are 

otherwise terminated from the Contractor's employ, have their responsibilities changed resulting in their no longer being 
authorized to sigp contracts with theCommonwealth or whenever new signatories are designated. 

.. ' / 4A/^\ j) Date: 

v-/ Signature CJ T7 

Tide; ( £4 Telephone: J - Cl f' 

Fax: 7 .^ Email: ! (f^} (xOCY'kcJ ■ 

[Listing can not be accepted without all of this information completed.] 

A copy of this listing must be attached to the “record copy" of a contract filed with the department. 
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Attachment 5 


Additional Required Documents 
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Form W-9 
(Rev. August 2013) 
Department of the Treasury 
Internal Revenue Service 


Request for Taxpayer 
Identification Number and Certification 


Give Form to the 
requester. Do not 
send to the IRS. 


Q. ^ 

9- ° 


o 

vg 

o 

4) 

a 

V) 


Name (as shown on your income tax return) 

LOGICWORKS SYSTEMS CORPORATION __ 

Business name/disregarded entity name, if different from above 

LOGICWORKS _ 

Check appropriate box for federal tax classification: 

CD Individual/sole proprietor 0 C Corporation 0 S Corporation 

I~1 Limited liability company. Enter the tax classification (C=C corporation, S= 

CD Other (see instruction s) 

Address (number, street, and apt, or suite no,) 

155 AVENUE OF THE AMERICAS, 5TH FLOOR _ 

City, state, and ZIP code 

NEW YORK, NEW YORK 10013 

List account number(s) here (optional) 


CD Partnership 0 Trusl/estate 
S corporation, P=partnership) ► 


Exemptions (see instructions): 

Exempt payee code (if any) 

Exemption from FATCA reporting 
code (it any) 


Requester’s name and address (optional) 


Parti 


Taxpayer Identification Number (TIN) 


Enter your TIN in the appropriate box. The TIN provided must match the name given on the “Name" line 
to avoid backup withholding. For individuals, this is your social security number (SSN). However, for a 
resident alien, sole proprietor, or disregarded entity, see the Part I instructions on page 3. For other 
entities, It is your employer identification number (EIN). If you do not have a number, see How to get a 
TIN on page 3. 

Note. If the account is In more than one name, see the chart on page 4 for guidelines on whose 
number to enter. 


Part II 


Certification 



Under penalties of perjury, I certify that: 


1. The number shown on this form is my correct taxpayer identification number (or I am waiting for a number to be issued to me), and 

2. I am not subject to backup withholding because: (a) I am exempt from backup withholding, or (b) I have not been notified by the Internal Revenue 
Service (IRS) that I am subject to backup withholding as a result of a failure to report all interest or dividends, or (c) the IRS has notified me that I am 
no longer subject to backup withholding, and 


3. I am a U.S, citizen or other U.S. person (defined below), and 

4. The FATCA code(s) entered on this form (if any) indicating that I am exempt from FATCA reporting is correct. 

Certification instructions. You must cross out Item 2 above if you have been notified by the IRS that you are currently subject to backup withholding 
because you have failed to report all interest and dividends on your tax return. For real estate transactions, item 2 does not apply. For mortgage 
interest paid, acquisition or abandonment of secured property, cancellation of debt, contributions to an individual retirement arrangement (IRA), and 
generally, payments other than interest and divldendq^you are not required to sign the certification, but you must provide your correct TIN. Seethe 
instructions on page 3. 


Sign 

Here 


Signature of 
U.S. person 


^cmtrtlleg 


General Instructions 

Section references are to the Internal Revenue Code unless otherwise noted. 
Future developments. The IRS ras'dreated a page on IRS.gov for information 
about Form W-9, at www.f/s.govAvf?. Information about any future developments 
affecting Form W-9 (such as legislation enacted after we release it) will be posted 
on that page. 

Purpose of Form 

A person who is required to file an information return with the IRS must obtain your 
correct taxpayer identification number (TIN) to report, for example, income paid to 
you, payments made to you in settlement of payment card and third party network 
transactions, real estate transactions, mortgage interest you paid, acquisition or 
abandonment of secured property, cancellation of debt, or contributions you made 
to an IRA. 


withholding tax on foreign partners’ share of effectively connected income, and 
4. Certify that FATCA code(s) entered on this form (if any) indicating that you are 
exempt from the FATCA reporting, Is correct. 

Note. If you are a U.S. person and a requester gives you a form other than Form 
W-9 to request your TIN, you must use the requester’s form if it Is substantially 
similar to this Form W-9. 

Definition of a U.S. person. For federal tax purposes, you are considered a U.S. 
person if you are: 

• An individual who is a U.S, citizen or U.S. resident alien, 

• A partnership, corporation, company, or association created or organized in the 
United States or under the laws of the United States, 

• An estate (other than a foreign estate), or 

• A domestic trust (as defined in Regulations section 301.7701-7). 


Use Form W-9 only If you are a U.S. person (including a resident alien), to 
provide your correct TIN to the person requesting it (the requester) and, when 
applicable, to: 

1. Certify that the TIN you are giving is correct (or you are waiting for a number 
to be issued), 

1 . Certify that you are not subject to backup withholding, or 

3. Claim exemption from backup withholding if you are a U.S. exempt payee. If 
applicable, you are also certifying that as a U.S. person, your allocable share of 
any partnership income from a U.S. trade or business is not subject to the 


Special rules for partnerships. Partnerships that conduct a trade or business in 
the United States are generally required to pay a withholding tax under section 
1446 on any foreign partners* share of effectively connected taxable income from 
such business. Further, in certain cases where a Form W-9 has not been received, 
the rules under section 1446 require a partnership to presume that a partner is a 
foreign person, and pay the section 1446 withholding tax. Therefore, if you are a 
U.S. person that is a partner in a partnership conducting a trade or business in the 
United States, provide Form W-9 to the partnership to establish your U.S. status 
and avoid section 1446 withholding on your share of partnership income. 


Cat. No. 10231X 


Form W-9 (Rev. 8-2013) 




COMMONWEALTH OF MASSACHUSETTS May 2004 

CONTRACTOR AUTHORIZED SIGNATORY LISTING 


CONTRACTOR LEGAL NAME : 

CONTRACTOR VEND OR/C U STOMER CODE: 

INSTRUCTIONS: Any Contractor (other than a sole-proprietor or an individual contractor) must provide a listing of 
individuals who are authorized as legal representatives of the Contractor who can sign contracts and other legally binding 

documents related to the contract on the Contractor’s behalf. In addition to this listing, any state department may require 
additional proof of authority to sign contracts on behalf of the Contractor, or proof of authenticity of signature (a notarized 
signature that the Department can use to verity that the signature and date that appear on the Contract or other legal 

document was actually made by the Contractor's authorized signatory, and not by a representative, designee or other 
individual.) 



NOTICE; Acceptance of any payment under a Contract or Grant shall operate as a waiver of any defense by the 
Contractor challenging the existence of a valid Contract due to an alleged lack of actual authority to execute the 
document by the signatory. 

For privacy purposes DO NOT ATTACH any documentation containing personal information, such as bank account 
numbers, social security numbers, driver's licenses, home addresses, social security cards or any other personally 
identifiable information that you do not want released as part of a public record. The Commonwealth reserves the right to 
publish the names and titles of authorized signatories of contractors. 


AUTHORIZED SIGNATORY NAME 

TITLE 

_ jel/) *2.1 g 

CB o 

TTfi/J _ At/ cof<A _ 

i/P trp J-C'liM'f SwftCLS 


(/P O'P ‘Teel'iVc* J 

A TWA " J 

1/ f C <?C, 1 c -}, c r 

A/V I(a y 

CotA -fro If Y 


I certify that 1 am the President, Chief Executive Officer, Chief Fiscal Officer, Corporate Clerk or Legal Counsel for the 
Contractor and as an authorized officer of the Contractor I certify that the names of the individuals identified on this 
listing are current as of the date of execution below and that these individuals are authorized to sign contracts and other 
legally binding documents related to contracts with the Commonwealth of Massachusetts on behalf of the Contractor. I 
understand and agree that the Contractor has a duty to ensure that this listing is immediately updated and communicated to 
any state department with which the Contractor does business whenever the authorized signatories above retire, are 

otherwise terminated from the Contractor’s employ, have their responsibilities changed resulting in their no longer being 
authorized to si^p contracts with theCjommonwealth or whenever new signatories are designated. 

Date: 

Title: ( £4 Telephone: , Ql f- ^ ^ 

Fax: Yf Email: ■ 

[Listing can not be accepted without all of this information completed.] 

A copy of this listing must be attached to the "record copy” of a contract filed with the department. 
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COMMONWEALTH OF MASSACHUSETTS May '2004 

CONTRACTOR AUTHORIZED SIGNATORY LISTING ^ 

CONTRACTOR LEGAL NAME : 

CONTRACTOR VENDOR/CUSTOMER CODE: 



PROOF OF AUTHENTICATION OF SIGNATURE 


This page is optional and is available for a department to authenticate contract signatures. 
It is recommended that Departments obtain authentication of signature for the signatory 
who submits the Contractor Authorized Listing. 


This Section MUST be completed by the Contractor Authorized Signatory in presence of notary. 
Signatory's full legal name (print or type): 

Title: /? XL X 

x dJ ox 

Signature as it will appeaptpn contract c)f other document (Complete only in presence of notary): 


AUTHENTICATED BY NOTARY OR CORPORATE CLERK (PICK ONLY ONE) AS FOLLOWS: 


LL ^ VP .S _ ^ __ (NOTARY) as a notary public certify that I 

witnessed the signature of the aforementioned signatory above and I verified the individual's identity on this 
date: 


e _,20 


My commission expires on: 


CLAUDIA VOS 

NOTARY PUBLIC-STATE OF NEW YORK 
No. 01V06279695 
Qualified In Queens County 
My Commission Expires April 15 , 2017 


AFFIX NOTARY SEAL 


_________ (CORPORATE CLERK) certify that I 

witnessed the signature of the aforementioned signatory above, that I verified the individual’s identity and 
confirm the individual’s authority as an authorized signatory for the Contractor on this date: 

_ _ , 20 __. 


AFFIX CORPORATE SEAL 
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Form 


© COMMONWEALTH OF MASSACHUSETTS 

OFFICE OF THE COMPTROLLER 
Electronic Funds Transfer Sign Up Form 

Is form should be sent to a department with whom you do business. 


Request type must be checked: ^.Initial Request □ Changing Existing Account □ Closing Account 

WtOfrcVC 

1_ £ \S(Lrt _, hereby certify that the account/s indicated on this form is under my direct control and 

access; therefore, I authorize the State Treasurer as fiscal agent for the State of Massachusetts to initiate, change 
or cancel credit entries to that account/s as indicated on this form. For ACH debits consistent with the 
International ACH Transaction (1AT) rules check one: 

TSJ til firm that payments authorized hereunder are not to an account that is subject to being transferred to 
a foreign bank account. 

□ 1 affirm that payments authorized hereunder are to an account that is subject to being transferred to a 
foreign bank account. 

T his authority is to remain in full force and effect until the Office of Comptroller has received written notification, 
from either me or an authorized officer of organization of the account's termination in such time and in such a 
manner as to afford CTR a reasonable opportunity to act upon it. 


VENDOR BANK INFORMATION 

Vendor Bank Name: 

Vendor Bank Transit Number (ABA): 

Vendor Bank Account Number: 

Account Type: 

Filling out this field is a requirement for changing account number 

Vendor Bank Old Account Number: _ 

Account Type: ___ 



VENDOR INFORMATION 


Vendor Tax Identification Number (TIN):_ 

Vendor/Business Name: _ 

Vendor Contact Name: _____ 

E-mail: ___ 

Telephone: _ 

Address; __ 

c '»y: _State:_Zip: 


I his authorization will remain in effect until either canceled in writing or an updated form changing information 
is sent to the Department you currently do business with. 


AUTHORIZED SIGNATURE: 
Print Name. fi/VlOocllC gjjj 


Form forwarded to Commonwcalt’ 
Attached voided check here: 





. Title: CLnAvrAlCy 


Date: (gJ 1 CfJ T4- 


epaitment: 
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COMMONWEALTH OF MASSACHUSETTS 
Prompt Pay Discount Form 

(Invoice discounts for receiving fast payments) 

Bidder Name: _ L~ ^ °\ P C UsO ( (c^> IT (j4-~ r'/rp.J, (_£> ( pc Rev i s ^d 3/9/07 

Vendor Code (VCUST1: _ * ' _ 

Contract/RFR Numberfs): 

P rompt Payment Discounts (PPD) , All contractors/vendors doing business with the Commonwealth must 
provide a Prompt Payment Discount (PPD) for receiving early payments unless the Contractor/vendor can 
provide compelling proof that providing a prompt pay discount would be unduly burdensome. Contractors 
benefit from PPD by Increased, usable cash flow as a result of fast and efficient payments for commodities 
or sen/ices rendered. Contractors who agree to accept Electronic Funds Transfer (EFT) increase the prompt 
pay benefit by ensuring that funds are paid directly to their designated bank accounts, thus eliminating the 
delay of check clearance policies and traditional mail lead time, Payments processed through the state 
accounting system (MMARS) can be tracked and verified through the Comptroller's Vendor Web system 
using the Vendor/Customer Code assigned to you by a Commonwealth department. 

The Commonwealth benefits because contractors reduce the cost of products and services through the 
applied discount. While Bidders/Contractors have flexibility in determining the actual % discount(s) offered 
to the Commonwealth, the discount(s) must be identified for 10, 15, 20 and/or 30 days for payment 
issuance in the column entitled "% Discount Off Proposed Price" below. The Commonwealth may use the 
prompt pay discounts submitted as a basis for selection and may negotiate discounts as deemed in the best 
interest of the Commonwealth. The requirement to offer PPD discounts may be waived by the 
Commonwealth on a case-by-case basis if participation in the program would be unduly burdensome, 
provided the specific reason for the hardship is outlined below. 

All discounts offered will be taken in cases where the payment issue date is within the specified number 
of days listed below and in accordance with the Commonwealth's Bill Paying Policy. Payment days will be 
measured from the date goods are received and accepted / performance was completed OR the date an 
invoice is received by the Commonwealth, whichever is later to the date the payment is issued as an EFT 
(preferred method) or mailed by the State Treasurer. The date of payment "issue" is the date a payment 
is considered "paid" not the date a payment is "received" by a Contractor. 

If internal Bidder/Contractor systems require an alternate method of measuring payment issue dates, the 
Bidder/Contractor must note the issues below or on an attached page if necessary to be considered by 
the PMT. In cases where the Bidder/Contractor considers that offering a Prompt Payment Discount would 
be a hardship, the Bidder must clearly define the issues and reasons for said hardship. Providing volume 
discounts or other discounts on prices is not considered a hardship , since the PPD provides the additional 
benefit of early cash flow for the Contractor. 

Enter the Prompt Payment Discount percentage (%) off the invoice payment, for each of the payment 
issue dates listed, if the payment is issued within the specified Payment Issue days. For example: 

5% - 10 Days 
4% - 15 Days 
3% - 20 Days 
2% - 30 Days 


If no discount is offered enter 0% 


Prompt Payment Discount % 

Payment Issue Date w/in 

% 

10 Days 

% 

15 Days 

% 

20 Days 

% 

„ 30 Days 

- ,/P- ^ ---- 


The Contractor is unable to provide a prompt payment diScopht du€lo ttie-jfoljowing hardship: 


Contractor/Bidder Authorized Signature /Av/ ^ s Date: 6 j I ^ j ZPPj 

Contractor/ Bidder Authorized Signatory Print Name and Titled Cl' ‘-d 
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